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ABOUT THE NIAC 


The National Infrastructure Advisory Council (NIAC) provides the President of the United States with 
advice on the security and resilience of the critical infrastructure sectors and their functional 
systems, physical assets, and cyber networks. These critical infrastructure sectors span the U.S. 
economy and include the Water; Chemical; Commercial Facilities; Communications; Critical 
Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Financial Services; Food 
and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; 
Nuclear Reactors, Materials, and Waste; and Transportation Systems Sectors. The NIAC also advises 
the lead Federal agencies that have critical infrastructure responsibilities. Specifically, the Council 
has been charged with making recommendations to: 

Enhance the partnership of the public and private sectors in securing and enhancing the 
security and resilience of critical infrastructure and their functional systems, physical assets, 
and cyber networks, and provide reports on this issue to the President through the 
Secretary of Homeland Security, as appropriate. 

Propose and develop ways to encourage private industry to perform periodic risk 
assessments and implement risk-reduction programs. 

Monitor the development and operations of critical infrastructure sector coordinating 
councils and their information-sharing mechanisms, and provide recommendations to the 
President through the Secretary of Homeland Security on how these organizations can best 
foster improved cooperation among the sectors, the U.S. Department of Homeland Security, 
and other Federal Government entities. 

Report to the President through the Secretary of Homeland Security, who shall ensure 
appropriate coordination with the Assistant to the President for Homeland Security and 
Counterterrorism, the Assistant to the President for Economic Policy, and the Assistant to 
the President for National Security Affairs. 

Advise Sector-Specific agencies with critical infrastructure responsibilities, to include issues 
pertaining to sector and government coordinating councils and their information-sharing 
mechanisms. 
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EXECUTIVE SUMMARY 


Water is often called our most precious resource, and with good reason— clean drinking water and 
wastewater treatment services 1 sustain core functions of critical infrastructure, communities, and 
human life itself. Without water services, factories shut down, hospitals close, communities are 
disrupted, and most hotels, restaurants, and businesses cease operations. Water is a lifeline sector 
that serves businesses and communities on a daily basis and brings them back to normal after a 
disaster, which makes maintaining water services and quickly restoring them a priority. Because the 
sector has a track record of reliable service with few major disruptions, the infrastructure that 
delivers water often goes unnoticed and undervalued by decision-makers and the public-at-large. 

The National Infrastructure Advisory Council (NIAC) was asked to 1) assess security and resilience in 
the Water Sector, 2) uncover key water resilience issues, and 3) identify potential opportunities to 
address these issues. The Council formed a NIAC Working Group to examine water resilience using 
the framework developed in the NIAC's 2010 study on establishing resilience goals. This six-member 
group of NIAC members examined national-level issues related to water infrastructure systems 
based upon each of their own unique experience from across a myriad of sectors, numerous specific 
interviews with subject matter experts, and valuable input from the Study Group, support the 
findings and recommendations in the report. 

The crisis in Flint, Michigan reveals how a loss of safe 
drinking water in a compromised water infrastructure can 
devastate a community. Yet this tragedy belies another 
critical risk: the loss of water services can cripple other 
critical infrastructures and trigger additional disruptions. 

An analysis of vulnerability assessments conducted by the 
U.S. Department of Homeland Security (DHS) Office of 
Cyber and Infrastructure Analysis (OCIA) revealed that 
among surveyed critical infrastructure that depend upon 
water for core operations, services are degraded 50 
percent or more within eight hours of losing drinking 
water services (Exhibit ES-1). 2 The same holds true for a 
loss of wastewater treatment services. For example, the 
OCIA analysis noted that nearly all hospital functions 
could be degraded within two hours due to a loss of 
external wastewater discharge services. Yet, many 
infrastructure owners and operators do not have 
alternative sources of water or wastewater services. As a result, the full consequences of cascading 
failures from extended water service disruptions in critical sectors are not well understood. 


® • What happened here is just an 
extreme example, an extreme and 
tragic case of what’s happening in a lot 
of places around the country.We’ve 
seen unacceptably high levels of lead in 
townships along the Jersey Shore and in 
North Carolina’s major cities.We’ve 
seen it in the capitals of South Carolina 
and Mississippi. And even, not long ago, 
lead-contaminated drinking water was 
found right down the street from the 
United States Capitol. So Flint is just a 
tip of the iceberg in terms of us 
reinvesting in our communities.” 

President Barack Obama, May 4,2016 in 
Flint, Michigan 


1 "Water services" are used throughout this report to refer to both drinking water and wastewater treatment 
services. It does not include upstream water resources and separate storm water systems. Chapter I. 
Introduction, Section A. Framing the Study describes the scope of this study in detail. 

2 DHS OCIA, Sector Resilience Report, 2014. 


NIAC Water Sector Resilience Final Report and Recommendations 


I 




Exhibit ES-I. Critical Infrastructure Dependence on Water and Potential Function Degradation 
Following Loss of Water Services 3 



Percent of surveyed 


Average degradation 

facilities that reported a 


reported by surveyed 

dependency on water, by 


facilities in voluntary 

sector 


self-assessment 


3 The information provided in the graphic is based on a limited sample of 2,661 voluntary facility assessments 
conducted between January 2011 and April 2014 (DHS OCIA, Sector Resilience Report, 2014). (See pages 19-20 
for more information.) 
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This study builds on the insights gained in our previous studies of resilience in the lifeline sectors of 
electricity and transportation. Although the Council found many similarities in the challenges, root 
causes, and opportunities facing these sectors, we also uncovered distinct challenges that the 
Nation's water infrastructure faces in building a more resilient sector: 

Community water systems are not typically connected to adjacent systems, unlike electricity 
and transportation infrastructure, which are interconnected into national networks. 

Roughly 85 percent of all water and wastewater systems are publicly owned and operated 
by municipalities and most are small; more than 80 percent of community water systems 
and publicly owned treatment works serve populations of less than 3,300. 

Most State and municipal decision-makers are constrained by long-held expectations by 
customers for water as a low-cost, affordable service that does not account for true life- 
cycle costs. 

Nearly all water infrastructure assets are out of sight and historically reliable, leading to an 
underappreciation of the criticality of water services and the infrastructure that deliver 
them. 

• Like other sectors, water has an aging infrastructure that requires massive reinvestment to 
upgrade pipes, mains, and equipment. Many assets are nearing or beyond their expected 
lifespan, leading to roughly 240,000 water main breaks and between 23,000 and 75,000 
sanitary sewage overflows per year in the United States. The estimated investment gap 
ranges from about $400 billion to nearly $1 trillion to maintain current levels of water 
service. 

Unlike the Energy and Transportation Sectors, which each have a Federal department and 
Cabinet position dedicated to their sectors and infrastructure, water has no corresponding 
Federal department dedicated to its sector. The U.S. Environmental Protection Agency 
(EPA), which serves as the Sector-Specific Agency (SSA) for the Water Sector, regulates and 
enforces the Clean Water Act and the Safe Water Drinking Act. While it has programs 
designed to improve the security and resilience of the Nation's drinking water and 
wastewater infrastructure, its primary mission is ensuring water quality. 

WHAT WE FOUND 

The affordability of systems—the ability of providers and their ratepayers to develop and maintain 
needed capabilities—is a cornerstone resilience issue. Too many jurisdictions do not account for the 
full life-cycle cost of building, maintaining, upgrading, and replacing systems; or are unable or 
unwilling to raise rates to pay for needed investment. Rates may simply reflect the least-cost path of 
patch and repair, ignoring longer-term problems and consequences, even under nonstressed 
conditions. 

Over the course of this study, the importance of water services was underscored by the crisis that 
unfolded in Flint, Michigan. While the contamination of the Flint water supply was not the direct 
result of a failure in infrastructure resilience—and therefore beyond the direct scope of this study— 
it reveals the impact that compromised water services can have on communities, government, and 
families, and the breakdown in trust that Americans have placed in our water infrastructure. 
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Our findings highlight the criticality of water services, the need to address emerging risks, and the 
significant challenge of funding needed improvements to water and wastewater infrastructure. 


Poor Understanding of the Criticality of the Water Sector: The Water Sector is facing a 
dynamic and complex risk environment in which the full impacts of water disruptions and 
the potential cascading impacts are not fully understood among critical infrastructure 
operators, local and State leaders, and water service customers. As such, water and 
wastewater services are receiving inadequate attention in disaster planning, prevention, 
and response among public officials and dependent sectors. 

Inadequate Valuation of Water Services: Water services are often taken for granted 
because they have been highly reliable, inexpensive, and hidden from view. This makes it 
difficult to gain public support for needed upgrades and for decision-makers to justify rate 
increases needed to fund infrastructure improvements. 

Wide Disparity of Capabilities and Resources: Water utilities face a challenging risk 
environment for which many lack the required technical and financial capabilities to address 
all emerging risks, such as cyber risks. Utilities, especially small municipal agencies, often 
lack sufficient resources—including qualified staff, tools, and access to technical expertise 
and reliable information—to manage new risks. 

Significant Underinvestment in Water Sector Resilience: The large portion of public 
ownership within the sector and the current regulatory structure hinders long-term 
investment in resilient water infrastructure. Decaying infrastructure is mostly unseen, and 
problems are not elevated in the public eye until there are major failures. 

Fragmented and Weak Federal Support for Water Resilience: Resilience has not been 
substantially integrated into the actions of Federal agencies and resilient outcomes are 
typically not part of Federal programs and resources. 

Regional Collaboration Not Broadly Applied: Poor cross-jurisdictional collaboration can lead 
to stovepiped decisions that can be counterproductive to effective emergency response and 
recovery. 


RECOMMENDATIONS 


The Council recommends the following steps to improve resilience in the Water Sector. For each 
recommendation, we have identified specific actions that the Federal Government should take to 
implement these recommendations. (Chapter V. Findings and Recommendations, starting on page 
35, includes a complete description of the recommendations and specific actions.) 



Analyze and map the complex risks of major water 
disruptions and develop mitigations. 


The Federal Government should assist owners and operators in the Water Sector to uncover 
emerging cross-sector risks and develop mitigations for disruptions that could cascade into 
other sectors and regions or have the potential for national consequences. The Federal 
Government should commit funding and expert resources to help identify, analyze, and map 
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hidden risks that result from complex sector interdependencies, regional interconnections, and 
increased convergence of physical-cyber systems. 


Recommendation 2 


Fortify Water Sector response and recovery capabilities. 


The Water Sector has a good track record of maintaining continuity of service and rapid 
response and recovery. However, because of the criticality of water and wastewater services, 
the Federal Government should take immediate actions to formalize and improve the response 
and recovery capabilities at every level of the Water Sector. The Federal Government should 
increase planning for extreme events, consolidate Federal response responsibilities, and 
increase funding for successful sector mutual aid efforts. 


Recommendation 3 


Increase Federal funding, investment, and incentives to 
improve water infrastructure resilience. 


The Federal Government should establish new funding mechanisms, structures, and incentives 
to increase investment in resilience at the regional and local levels to counter historic 
underinvestment in infrastructure, and to remove obstacles that public agencies face in 
increasing rates, particularly when it impacts low-income communities. 


Recommendation 4 


Increase technical and financial resources and 
expertise available to the Water Sector. 


The Federal Government should work with larger, well-resourced utilities to improve the 
technical and financial capabilities of smaller and less-resourced utilities by creating programs 
that link regional technical resources to local water utilities, and leverage established programs, 
expertise, and capabilities of universities. The Federal Government should also assist national 
and regional water associations to expand outreach to utilities to improve access to valuable 
tools and models. These efforts should emphasize improving the cybersecurity capabilities of 
water utilities that have limited cyber capacity. 


Recommendation 5 


Strengthen Federal leadership, coordination, and 
support for Water Sector resilience. 


The President should strengthen Federal leadership on water infrastructure issues by directing a 
coordinated effort across Federal agencies to raise awareness about the importance of water, 
leveraging investment to create job opportunities and inclusion for local communities, and 
identifying and removing legal, regulatory, and policy barriers that impede investment and 
implementation of resilient measures. 


MOVING FORWARD 

The Council confirms what we found in our four previous studies of resilience: much of our most 
critical national infrastructure is crumbling and in major need of renewal and increased investment. 
The Water Sector is no different. Flint provides a stark example of what can happen to distort 
decision-making when resources are inadequate to do the job. But the same holds true for almost 
every major infrastructure failure in recent years—New Orleans levee breaches, Minnesota bridge 
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collapse, Washington Metro fires; they were all exacerbated by a lack of investment in system 
preservation. 

Simply put, we have failed to make reinvestment in our infrastructure a top national priority. The 
condition of our infrastructure seriously lags behind in an increasingly competitive global economy, 
but we have been unable to generate the overall public interest, support, and political will to 
reinvigorate it. We have failed to recognize that investment in our infrastructure is also an 
investment in our people, our communities, and our economy. Cities and communities across the 
country face chronic unemployment and under employment, inequality, and affordability challenges 
that require urgent national action. Special attention must also be given to our most vulnerable 
populations in high needs communities. The weak levees in New Orleans and the corroding lead 
pipes in Flint drive home important lessons about the need for public/community engagement, 
greater accountability/transparency, and expanded partnerships in building and operating critical 
infrastructures. 

New investments in smart, sustainable, resilient infrastructure is a catalyst for job creation, 
economic competitiveness, and an equitable and shared prosperity. To be sure, the risks are 
complex, the investments required are massive, and the task exceeds the capabilities of any one 
company, sector, or government agency. But we are beginning to see local support for ballot 
measures for major infrastructure investments, and projects at the local level that actively engage 
local communities, including a host of partners—business, government, community advocates, 
education, labor, and philanthropic organizations. 

A great deal needs to be done to strengthen the security and resilience of critical infrastructure. 
Although much of the responsibility rests with the owners and operators who design, build, operate, 
maintain, and repair the infrastructure, the Federal and State governments are critical partners in 
this endeavor. Federal and State governments must make it easier for the owners and operators to 
invest in infrastructure improvements; they must identify and remove regulatory barriers that 
inhibit resilient behavior; they must help to identify and mitigate cross-sector risks that hide 
between the seams of interdependent sectors and regions; they must develop measurable 
standards and best practices to guide water agencies in their resilience efforts; they must leverage 
the science and engineering resources of national laboratories and universities to develop 
innovative technologies and bring them to market; and they must strengthen leadership and 
coordination among agencies across all levels of government. We believe this study, along with our 
previous ones, provides a practical template for action that can help ensure the long-term security 
and economic prosperity of the Nation's critical infrastructure. 
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I. INTRODUCTION 


The National Infrastructure Advisory Council (NIAC)—a Federal advisory committee that advises the 
President on issues relating to the security and resilience of the Nation's critical infrastructure 
sectors and their supporting information systems—was charged with examining the resilience of the 
Water Sector in September 2015. Specifically, the NIAC was asked to 1) assess security and resilience 
in the Water Sector, 2) uncover key water resilience issues, and 3) identify potential opportunities to 
address these issues. The study found that many security measures—as defined in Presidential 
Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience— are embedded in good 
resilience practices. Accordingly, the resilience focus of the report encompasses many aspects of 
security, defined in PPD-21 as "reducing the risk to critical infrastructure by physical means or 
defined cyber measures." 4 

This report presents the Council's findings and recommendations to the President, highlighting 
opportunities for the Federal Government to address key water resilience issues. Over the past 
seven years, the NIAC has examined resilience in four previous studies. In this work, the Council 
defined infrastructure resilience as "the ability to reduce the magnitude and/or duration of 
disruptive events" as determined by the "ability to anticipate, absorb, adapt to, and/or rapidly 
recover from a potentially disruptive event." This definition directly parallels the definition in PPD- 
21: "the ability to prepare for and adapt to changing conditions and withstand and recover rapidly 
from disruptions." 5 Simply put, resilient systems lose fewer functions during a disruption and 
require less time and resources to recover to normal operations. 


NIAC AND RESILIENCE: A FOUNDATION FOR COLLABORATIVE SUCCESS 


The NIAC examined resilience needs and practices, developing distinct recommendations in four studies: 

Critical Infrastructure Resilience (October 2009) examined steps government and industry should take 
to best integrate resilience and protection into a comprehensive risk-management strategy. 

A Framework for Establishing Critical Infrastructure Resilience Goals (October 2010) developed a 
process framework for setting, testing, and improving resilience goals in the Electricity Sector that can 
be broadly applied to all lifeline sectors. 

Strengthening Regional Resilience (October 2013) examined the characteristics of critical 
infrastructure resilience in mitigating regional disruptions, finding that resilience in the lifeline 
sectors—energy, communication, water, and transportation—is particularly critical. 

Transportation Sector Resilience (July 2015) identified key actions that the Federal Government should 
take to strengthen the resilience of the Transportation Sector. 


4 The White House, PPD-21, 2013. 

5 Ibid. 
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A. FRAMING THE STUDY 


Water infrastructure consists of the physical and cyber assets of drinking water and wastewater 
systems, as defined by Homeland Security Presidential Directive 7 (HSPD-7), the 2013 National 
Infrastructure Protection Plan (NIPP 2013), and the 2015 Water and Wastewater Systems Sector- 
Specific Plan (2015 SSP). 6 Exhibit 1-1 illustrates the scope of the study, limiting the focus to water 
supply and wastewater, and indirectly stormwater as it affects combined wastewater treatment. 


Exhibit l-l. Scope of NIAC Water Resilience Study 


WATER RESOURCES 


WASTEWATER 


Hundreds of cities 
have combined 
wastewater systems 
that collect 
wastewater and 
STORMWATER stormwater. 



While water resources are critical, this study focused on the resilience of the Nation's water delivery 
infrastructure, rather than on the sufficiency of water resources. The Nation faces many water 
resource issues, including the drought in California, potential water shortages in the Southwest, and 
balancing flood control and water needs. These are all critical issues that impact the Water Sector, 
but are outside the direct scope of this study. 

B. STUDY RESOURCES AND ACTIVITIES 


To conduct this study, the Council formed the Water Resilience Working Group, consisting of NIAC 
members, to examine water resilience using the framework developed in our 2010 study on 
establishing resilience goals in the Electricity Sector. This six-member group of NIAC members 
convened to examine national-level issues related to water infrastructure systems based upon each 
of their own unique experience from across a myriad of sectors. The collective insights gained from 
the Working Group's expertise, extensive subject matter expert interviews, literature reviews, and 
findings and conclusions provided to the Working Group by a supporting Study Group—convened by 
the Working Group to look at specific technical, financial, and operational issues—provides the 
confidence that the Council's findings and recommendations are well grounded. 


6 The White House, HSPD-7, 2003; DHS, NIPP 2013, 2013; and EPA, 2015 SSP, 2016. 
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More than 70 subject matter experts (SMEs) were 
interviewed as part of the study, representing a mix of 
utilities of different sizes, geographic locations, water 
association staff and members, consultants and 
academics, and representatives from government 
agencies with a role in in the Water Sector. These 
SMEs contributed knowledge about utility operations, 
sector risks, dependencies, planning and investments, 
severe weather, emergency management, 
cybersecurity, next-generation resilience, and financial 
solutions. Additional information can be found in 
appendices at the end of the report: 

Appendix A. Acknowledgements — A list of all 
study contributors and subject matter experts 
interviewed. 

Appendix B. Compendium of Information from 
Subject Matter Experts — A synopsis of the 
information provided during interviews. 


® • Water challenges are facing 
communities and regions across the 
United States, impacting millions of 
lives and costing billions of dollars in 
damages. Recent events, including 
record-breaking drought in the West, 
severe flooding in the Southeast, and 
the water-quality crisis in Flint, Ml, have 
elevated a national dialogue on the 
state of our Nation’s water resources 
and infrastructure.This dialogue is 
increasingly important as a growing 
population and changing climate 
continue to exacerbate water 
challenges.” 

The Executive Office of the President, 
Commitments to Action on Building a 
Sustainable Water Future, March 22, 
2016 


Appendix C. Disruption Scenario Case Study — An overview of the five disruptions evaluated 
by the Study Group. 


Appendix D. Study Group Findings and Conclusions — A list of the findings and conclusions 
developed by the Study Group. 


Appendix E. Compendium of Prior Recommendations — A review of prior recommendations 
and other sources most relevant to this study. 
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II. WATER SECTOR OPERATIONAL 
SNAPSHOT 


Most people do not think about what it takes for them to have clean water flow from their tap and 
wastewater removed. But these water and wastewater services rely on a vast network of 
infrastructure and assets from the pipes, water mains, and treatment plants; skilled facility 
employees; and information and technology networks that enable monitoring and communication. 
This Chapter provides a brief overview of the Water Sector. 

A. KEY ASPECTS OF THE WATER SECTOR 


There are thousands of water and wastewater treatment facilities in the United States, but the 
majority of the population is served by a small percentage of mostly large or very large systems. 
While individual utilities vary widely in size and complexity, Exhibit ll-l shows a typical design of 
both water and wastewater systems under normal operations. 


Water and wastewater systems are predominantly owned and operated by municipal entities. In 
2014, public entities provided water service to about 87 percent of people served by piped water. 7 
This is consistent with surveys done by the U.S. Environmental Protection Agency (EPA) that found 
that most people receive their water from large, publicly owned community water systems. 


Exhibit II-1. Typical Water and Wastewater Services Operation 


WATER SERVICE 


Electric lines 


Monitor and control 
facility operatons 
and security using 


Chemical delivery & 
employee transportation 
depend on reliable 
transit routes 

NV 



Secondary clarifier, settling Tertiary treatment 

Biosolid removal tanks Effluent discharge 


7 Food and Water Watch, State of Public Water, 2016. 
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WATER SECTOR SNAPSHOT 


ASSETS & INFRASTRUCTURE 


Water Supply 


There are approximately 53,000 Public Water Systems (PWSs) in the United States. PWSs provide 
water for human consumption through pipes and other constructed conveyances. 



Community Water Systems (CWS) 

A CWS is a PWS that provides residential water. LeSS 

than 20% of CWSs serve 92% of the 
population that receive water from 

CWSs The remaining 8% of the population are served 
by CWSs that serve less than 3,300 people.The majority of 
CWSs are publicly owned. About 16% are privately owned 
and about 2,000 government entities contract with private 
companies. There are more than 51,000 CWSs in the 
United States. 


© Non-Transient Non-Community 
Water Systems 

Schools, factories, office buildings, and hospitals that 
have their own water systems fall under this category. 
There are more than 18,000 of these systems. 



Transient Non-Community 
Water Systems 


Gas stations, campgrounds, or other places where 
people do not remain for long periods of time. 
There are approximately 84,000 of these systems. 


Wastewater 


Wastewater is predominantly treated by publicly owned treatment works.There are a small number of private 
facilities such as industrial plants. 



Publicly Owned Treatment 
Works (POTW) 

There are more than 16,500 POTWs in the United 

States. These systems provide wastewater service and 
treatment to more than 227 million people. POTWs are gen¬ 
erally designed to treat domestic sewage, but some receive 
wastewater from industrial users. 79% of POTWs treat less 
than I million gallons per day and provide treatment to less 
than 23 million people (approximately 10% of the population 
served by POTWs). 


Combined Sewer Systems (CSSs) 


CSSs collect stormwater, domestic sewage, and 
industrial wastewater in the same pipe to transport 
it to a wastewater treatment facility. In general, 

CSSs have not been constructed since the mid-20th 
century and many existing CSSs are looking for ways 
to separate stormwater and wastewater. CSSs 
serve approximately 40 million people in 772 
communities. 


ELEMENTS OF WATER SERVICES 

Water and wastewater utility assets can be characterized as physical, cyber, and human.The extent of these 
assets varies dramatically by utilities. 



• Pipes and Related Components 
for Collection and Conveyance 

• Treatment Facilities 

• Distribution/Discharge Systems 

• Sensors and Monitoring Systems 


• Industrial Control Systems 

• Process Systems and Operational 
Controls 

• Enterprise Systems 

Note: Individual drinking water utilities will differ 
in the types of components used; 


• Personnel Availability and Capabilities 

• Workforce Training and Education 

• Vendors and Contractors 


Source: EPA, 2015 Water and Wastewater Systems Sector-Specific Plan, (2015 SSP), 2016. 
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AFFORDABLE RATES DISGUISE CHRONIC UNDERINVESTMENT 

The affordability of systems—the ability of providers and their ratepayers to develop and maintain 
needed capabilities—is a cornerstone resilience issue for the sector. Utilities use a variety of rate 
structures to recover the costs of operating systems, including charging a flat fee regardless of the 
amount of water used, block rates based on usage, and seasonal rates. 8 For utilities, there are 
several factors that come into play when setting rates: revenue, conservation, and affordability. 9 
The rates charged must bring in enough revenue to maintain the system; however more and more 
customers are reducing the amount of water they use, decreasing revenue if rates are set based on 
usage. 10 Finally, utilities have to ensure that rates are affordable for disadvantaged customers, but 
do not encourage wasting of water. * 11 In response, utilities are experimenting with different rate 
structures to try to balance these three factors. 12 

In general, too many jurisdictions do not account for the full life-cycle cost of building, maintaining, 
upgrading, and replacing systems (whose life cycles can span decades). Moreover, it appears from 
our research and discussions that some utilities are diverting money collected as water fees for 
general revenue purposes. This was found to be true in Flint, when half of the collected fees were 
diverted in this manner. 13 As a result, aging U.S. water infrastructure has suffered from generations 
of underinvestment and is now prone to failure. In its 2013 Report Card for the Nation's 
infrastructure, the American Society of Civil Engineers (ASCE) gives both water and wastewater 
systems a "D" rating on an A to F report card scale. 

State and local governments must increase investment 
into public water systems to meet stricter Federal water 
quality and drinking water safety standards—yet Federal 
appropriations for water infrastructure have declined 
between 2008 and 2012. 14 Often dominated by politics 
rather than engineering, decisions that set rates may 
simply reflect the least-cost path of patch and repair, 
ignoring resilience needs. This exacerbates longer-term 
problems and consequences, stretching the problems of 
a degrading infrastructure into future political cycles and generations of customers. 

ATTRACTING AND MAINTAINING A HIGHLY SPECIALIZED 
WORKFORCE 

A critical component of the Water Sector is its workforce—the men and women who operate and 
maintain water utilities every day. The number of employees and specialized nature of their work is 


ll There is no more basic element 
sustaining human life than water. It’s not 
too much to expect for all Americans 
that their water is going to be safe.” 


President Barack Obama, May 4,2016, 
Flint, Michigan 


8 EPA, "Water Sense: Understanding Your Water Bill," 2016. 

9 Walton, "Price of Water 2016," 2016. 

10 Ibid. 

11 Ibid. 

12 Ibid. 

13 Snider, "Flint's other water crisis: Money," 2016. 

14 ASCE, "Drinking Water: Conditions and Capacity," 2013; and ASCE, "Wastewater: Investment and Funding," 


2013. 
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dependent on the type, size, and complexity of a utility. For example, larger facilities may employ 
chemists, engineers, microbiologists, public relations staff, systems analysts, security personnel, and 
other specialists who are highly trained in their individual roles and as a team. 15 

Most entry-level career paths in the Water Sector require a high school diploma while advanced 
positions typically require additional post-secondary education or on the job training. 16 Utilities also 
rely on outside contractors for engineering services, laboratory analyses, chemical deliveries, 
security, and other positions. 17 Because of the importance of water to other sectors, investments 
within the sector can have significant economic impacts on a community. A study of 30 water 
utilities in 25 geographic areas found that on average, for every $1 million these 30 utilities spent, 
five direct and 11 indirect jobs were supported. 18 

But a 2008 survey found that workforce planning was consistently cited as one of the top issues 
facing utilities. 19 Despite this concern, workforce planning may not receive the attention that 
regulatory or infrastructure issues receive. 20 Workforce could become an even greater issue for 
water utilities over the next several years. The Water Sector is in the midst of a concentrated 
retirement bubble—similar to other critical lifeline sectors—that is exacerbated by the specialized 
skills needed for the work, the localized nature of the sector, and eligibility for retirement after 30 
years. 21 Between 2010 and 2020, the Water Sector is expected to lose between 30 and 50 percent of 
employees to retirement. 22 Many of these employees have worked at the same utility for the 
majority of their careers, compounding the impact of these retirements due to the loss of 
institutional knowledge. 23 

Partnerships and collaboration between utilities, educational institutions, and other partners for 
resource sharing and technical support will be crucial in addressing workforce development, 
planning, and knowledge transfer. This is particularly true for smaller utilities with fewer resources. 


15 EPA, 2015 SSP, 2016. 

16 WRF and WERF, National Economic and Labor Impacts of the Water Utility Sector, 2014. 

17 EPA, 2015 SSP, 2016. 

18 WRF and WERF, National Economic and Labor Impacts of the Water Utility Sector, 2014. 

19 WRF and AWWA, Water Sector Workforce Sustainability Initiative, 2010. 

20 Ibid. 

21 Ibid. 

22 Ibid. 

23 Ibid. 
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B. FEDERAL RESOURCES FOCUS ON RECOVERY 
AND WATER QUALITY 

The Federal Government serves multiple roles in the sector, including regulator, enforcer, funder, 
and provider of critical aid and resources when service disruptions occur. This last role—providing 
critical aid and resources—is crucial during prolonged disruptions or shorter disruptions over a wide 
geographic area that can have national or regional consequences. Exhibit 11-2 shows how the Federal 
role increases with the duration and scope of an event. Smaller utilities may be strained even during 
disruptions lasting from 48 to 72 hours, while larger utilities with deeper technical, personnel, and 
financial resources may need relatively little aid during shorter or intermediate disruptions, while. 
Virtually all systems will need aid for prolonged disruptions. 

Exhibit 11-2. Severity of Events and Increasing National Consequence and Federal Role 


48-72 HOUR DISRUPTIONS 


POWER OUTAGES 
LOCAL DISRUPTIONS' 

• Most water utilities have backup power 
and can maintain operations 

• Smaller utilities may have limited backup 
power or smaller fuel reserves 


1-3 WEEKS 


SUPERSTORM SANDY® 

• Equipment damaged from storm surge inundation 

• Flooded areas restrict access and delay recovery 

• Facilities rely primarily on backup generation and available fuel 

• Facilities could cease operations resulting in limited water supply and 
untreated or partially treated sewage flowing into rivers, bays, and canals 


I MONTH+ 


NEW MADRID EARTHQUAKE™ 

• Water infrastructure within 200 miles of epicenter suffers major damage 

• Repairs may take months or years depending on the extent 

• Lack of water and wastewater service requires evacuation 

EXTREME GEOMAGNETIC STORM (EXTENDED POWER OUTAGE)" 

• Transformer damage along the Atlantic corridor between Washington, D.C. and New York City results in widespread power outages 

• Restoration is dependent on replacement of transformers, which takes several months 

• Long duration power outage results in widespread, sustained loss of water service 

• Depending on the extent of the damage, it could take between 16 days to 2 years to return to normal operations 


NATIONAL CONSEQUENCE AND FEDERAL ROLE 

1 DHS OCIA, Sector Resilience Report, 2014. 

H FEMA, Hurricane Sandy FEMA After-Action Report, 2013. 

jii Mid-American Earthquake Center,Virginia Tech, New Madrid Seismic Zone Catastrophic Earthquake Response Planning Project, 2009. 
iv Lloyd’s and Atmospheric and Environmental Research, Inc. (AER), Solar Storm Risk to the North American Electric Grid, 2013. 



The Federal Government's role is most prominent in the regulation of water and wastewater quality 
by EPA. The Safe Drinking Water Act (SDWA) provides the basis for drinking water security by 
protecting water quality and sources of drinking water. It applies to systems designed for the public 
to consume water through pipes and other constructed conveyances. Under the SDWA, the EPA sets 
and oversees the implementation of standards for drinking water quality. 
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EPA delegates primary enforcement responsibility (termed primacy) to States if they meet certain 
requirements. The majority of States and territories have received primacy. For jurisdictions that do 
not have primacy, such as the District of Columbia and Wyoming, an EPA regional office administers 
the drinking water program. 


STATE ROLE 


In addition to administering Federal regulations State agencies: 

Implement State initiatives and priorities 

Maintain inventories of drinking water and wastewater facilities 

Regularly inspect drinking water and wastewater facilities 

Provide technical assistance and training 

Maintain laboratory and operator certification programs 

Monitor compliance by reviewing analytical results 

Review and approve plans and specifications for new and expanded drinking water and 
wastewater facilities 
(Source: EPA, 2015 SSP, 2016.) 


The Clean Water Act (CWA), also implemented by EPA, governs the quality of discharges to surface 
and groundwater. It establishes national technology-based standards for municipal waste treatment 
and numerous categories of industrial point-source discharges (e.g., discharges from fixed sources). 
Under the National Pollutant Discharge Elimination System (NPDES) program, the permitting 
authority (either a State agency or EPA) designates the use for a body of water and then adopts 
water quality criteria to protect those uses, which inform the permitting of discharges from 
wastewater treatment facilities. 24 

EPA is the Sector-Specific Agency (SSA), or Federal lead, for the Water Sector under the designations 
identified in PPD-21. 25 Most of the current and projected programs of the Water Security Division 
for fiscal year 2016 focus on actions designed to support the implementation of one or more of the 
Water Sector's priority activities as outlined in the 2015 Water and Wastewater Systems Sector- 
Specific Plan (2015 SSP). This includes enhancing communication and coordination among utilities 
and government partners, and fostering engagements to strengthen public-private partnerships and 
improve response and recovery capabilities. 

EPA regularly communicates and coordinates with the U.S. Department of Flomeland Security (DHS) 
on Water Sector security and resilience, and works with DHS to implement presidential directives, 
executive orders, and statutes. Other Federal agencies that share aspects of the water security and 
resilience mission include the U.S. Army Corps of Engineers (USACE) for control of water resource 
infrastructure; the U.S. Department of the Interior (DOI) for dams, reservoirs, and water quality 
assessments; and the U.S. Department of Energy (DOE) for the interdependency between water and 
energy. 26 


24 EPA, 2015 SSP, 2016. 

25 EPA, 2015 SSP, 2016. 

26 Ibid. 
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Principal Federal funding available to States and municipalities is provided through two sources: EPA 
loans for water quality purposes and by the Federal Emergency Management Agency (FEMA) grants 
for emergency management. However, the pool of money available through FEMA is broader than 
just water and wastewater with FEMA grants going to a variety of qualified mitigation actions. 

EPA's Clean Water State Revolving Fund (SRF) and Drinking Water SRF are partnerships between EPA 
and the States to provide low-interest loans for eligible water and wastewater projects. States 
operate their SRF programs and have the flexibility to target financial resources to specific 
community and environmental needs. As the money is paid back, the States are able to make new 
loans. The programs can provide different types of assistance under certain conditions, including 
refinancing, purchasing, or guaranteeing loan debt and purchasing bond insurance. 27 By comparison, 
the U.S. Department of Transportation (DOT) provides formula-driven grant dollars to States and 
transit agencies based on factors such as population, lane miles, and system condition. These 
transportation trust fund dollars provide certainty to States and local governments in planning their 
future investments. See Appendix F. Federal Policies, Agencies, and Activities for more information 
about the Federal role in funding, oversight, and resilience activities. 

C. SECTOR PARTNERS OPERATE WITH A STRONG 
HISTORY OF COLLABORATION 


Water utilities have a long, productive history of working together through associations and other 
collaborative mechanisms. This collaboration has produced a wealth of shared resources, including 
vital information, mutual-support relationships, planning processes, and analytical tools. The Federal 
Government built on this tradition of collaboration by using the partnership model, specified in 
HSPD-7, PPD-21, and NIPP 2013 to bring private and public sector participants into the planning and 
implementation of sector protection and resilience. EPA chairs the Water Government Coordinating 
Council (GCC), including Federal, State, and local entities, and the owners and operators of water 
utilities comprise the Water Sector Coordinating Council (Water SCC). 


WATER SECTOR COORDINATING COUNCIL MEMBERSHIP 


The Water Sector Coordinating Council membership is composed of water utility managers, two each 
appointed by the following representative associations: Association of Metropolitan Water Agencies 
(AMWA), American Water Works Association (AWWA), Water Research Foundation (WRF), National 
Association of Clean Water Agencies (NACWA), National Association of Water Companies (NAWC), 
National Rural Water Association (NRWA), Water Environment Federation (WEF), and Water Environment 
Research Foundation (WERF). 

(Source: Water SCC, "Charter of the Water Sector Coordinating Council," 2014.) 


The Water SCC member associations serve as the liaisons between the broader water services 
community and the government partners represented by the Water GCC. 28 The GCC—composed of 
Federal and State government representatives and national associations representing States—is 


27 EPA, "Flow the Drinking Water State Revolving Fund Works," 2015; and EPA, "Learn about the Clean Water 
State Revolving Fund," 2016. 

28 Water SCC, "Charter of the Water Sector Coordinating Council," 2014. 
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chaired by EPA and co-chaired by the DHS Office of Infrastructure Protection. The GCC coordinates 
policy, strategy, and activities across government entities within the Water Sector. 

Through public-private partnerships, the private sector works with government entities to help 
foster the innovative financing and technology needed to build infrastructure, provide service and 
maintenance for operations, and develop advanced technologies to improve security and resilience. 
Examples of private sector involvement in the Water Sector include: 

• Vendors typically provide cyber assets, and some cyber operations positions may be staffed 
by contractors. 

American Water, the largest publicly traded water and wastewater utility company, 
launched a digital initiative with GE to harness advanced data and analytics to improve 
water infrastructure. 29 American Water is also collaborating with ComEd, an energy delivery 
company, on an Advanced Metering Infrastructure project to better manage water usage 
and water quality. 30 

WaterStart is an organization located in Nevada that works with domestic companies, water 
agencies, policy makers, and international entities to test promising water technologies to 
help bring them to market faster. 31 

In addition, nongovernmental organizations (NGOs), such as the One Drop Foundation, serve as key 
partners who can help bring attention, funding, and expertise to public-private partnerships. NGOs 
work both domestically and internationally to raise awareness, work collaboratively with public and 
private entities, raise funds for water infrastructure safety and preparedness, and help foster new 
technologies that can improve water supply and sustainability. 


29 American Water, "American Water COO Water Lynch Participates in White House Water Summit," 2016. 

30 Ibid. 

31 WaterStart, "What WaterStart Does," 2016; and Goldman, "Las Vegas is Betting It Can Become the Silicon 
Valley of Water," 2016. 
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III. WATER SECTOR RISKS AND CRITICAL 
INTERDEPENDENCIES 


Water services are essential to daily life, human health, and economic prosperity. Yet, these services 
are often misunderstood, undervalued, or taken for granted by both decision-makers and the 
public-at-large. 

A. CONSEQUENCES OF WATER SERVICE 
DEGRADATION AND LOSS 


When water and wastewater services are lost, even for short periods, the consequences can be 
widespread and dramatic. When these services are lost for an extended period of time, the results 
can be catastrophic. (See Exhibit II1-1). 


Exhibit lll-l. Consequence of Water and Wastewater Service Disruptions 


WATER & WASTEWATER: LOSS OF SERVICE HAS MAJOR 
PUBLIC HEALTH AND ECONOMIC IMPACTS 



Critical health 
services 
threatened as 

hospitals are forced 
to close. 


Limited or 
no water 
available for fire 
suppression 


People are forced 
to evacuate 
homes due to 
loss of water 
for drinking and 
sanitation. 


Schools, offices, 
and government 
facilities are shut 
down resulting in 
limited services 
and decreased 
productivity. 


Stores, 

restaurants, and 
other businesses 
are forced to 
close, causing lost 
revenue that impacts 
local economies. 


Manufacturing 
and commercial 
operations 
curtailed due to 

loss of water for 
cooling and other 
processes. 


Secure and resilient water and wastewater infrastructure is essential to daily life, ensuring the 
economic vitality of the Nation and maintaining public confidence in utility services. Maintaining 
these services has many challenges, including: 


The capability to manage loss of water services varies widely according to utility size, 
resource base, and other factors. 

The economic costs of preparation and response may mean that there are insufficient funds 
to prepare for and address risks ahead of time and to the level at which the risk requires. 


NIAC Water Sector Resilience Final Report and Recommendations 


18 



An aging workforce that may result in loss of institutional knowledge and skills as employees 
retire. 

Reduced water consumption and conservation may result in less revenue available to 
maintain level of service and undertake infrastructure resilience projects. 


While resilience—by nature—is a response to stressed conditions (natural or manmade disruptions 
to normal operating conditions), failures in nonstressed (normal) operating conditions may highlight 
underlying vulnerabilities that also affect resilience. The events such as those in Flint, Michigan show 
the underlying vulnerability of systems, and what can happen to a community when its water supply 
is disrupted. Resilience today in the Water Sector is very much a work in progress. 

The following sections discuss sector risk and current practice, challenges facing the sector, and 
indicators of progress toward a more resilient future. 


OTHER CRITICAL SECTOR SERVICES DEGRADE QUICKLY 
WITHOUT A FUNCTIONING WATER SECTOR 

The Water Sector is considered one of the lifeline sectors because its functions are essential to core 
operations in nearly every other critical sector. When water services are lost for relatively short 
periods (less than eight hours), the functioning of multiple sectors is significantly degraded (see 
Exhibit 111-2). 


Exhibit 111-2. Illustrative Impact of Water and Wastewater Disruption on Critical Sectors 32 



61V «* 


100 % 


94 % 




WATER 


. 


WASTEWATER 


Percent of surveyed 
facilities that reported a 
dependency on water/ 
wastewater, by sector 

Average degradation 
reported by surveyed 
facilities in voluntary 
self-assessment 


32 The information provided in the graphic is based on a limited sample of 2,661 voluntary facility assessments 
conducted between January 2011 and April 2014. The number of facilities represent a small fraction of the 
infrastructure across the United States, and respondents may not be geographically dispersed. The graphic 
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WATER OPERATIONS DEPEND HEAVILY ON OTHER LIFELINE 
SECTOR SERVICES 

While the Water Sector is critical to all sectors, it is interdependent with several key sectors. Exhibit 
II1-3 provides an overview of the impacts to water and wastewater services when electricity, 
communications, and transportation are disrupted. 

Significant points of interdependencies include: 33 

Chemical Sector: Chemicals are required to operate water and wastewater treatment 
facilities and water is often necessary in chemical manufacturing processes. 

Energy Sector: The Energy Sector relies on water services for different aspects of energy 
production and generation. The Water Sector relies on energy, specifically electricity, to 
operate its pumps, treatment facilities, delivery systems, and processing. Long-term power 
outages can overwhelm a water utility's backup energy supply or deplete fuel reserves. This 
scenario is worsened if the outage is systemic, in that multiple energy utilities in a region are 
shut down or multiple water utilities in a region have to compete for scarce backup 
resources. In addition, energy prioritization—the order in which disrupted sectors obtain 
energy services—may be an issue for water utilities as they work to restore services. 

Communications and Information and Technology (IT) Sectors: These sectors rely on water 
services for equipment cooling and facility operations, while the Water Sector relies on 
communications and IT for their operations and control systems, monitoring systems, 
internal communications, and communications with the public and emergency responders. 

Transportation Sector: Chemicals and other supplies are delivered by truck and rail. Water 
Sector personnel also rely on transportation to get to and from work. 


includes information on sectors where more than 60 percent of facilities within the group indicated a 
dependence on water or wastewater, and the percent degradation reported was the most frequent selection 
for the group—there may be other facilities that may be forced to evacuate after a certain amount of time 
within the sectors (DHS OCIA, Sector Resilience Report, 2014). 

33 DHS OCIA, Sector Resilience Report, 2014; and EPA, 2015 SSP, 2016. 
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Exhibit 111-3. Loss of Critical Infrastructure Services Effect on Water and Wastewater Services 


WATER SERVICE 


Closed routes block chemical 
shipments, employees, and 
emergency response. 



No wastewater movement 
through treatment process 


Untreated sewage is 
discharged into water bodies 


Storing drinking water for short-term use to protect public health may seem almost routine—think 
of stocking up on water bottles and filling a bathtub before a major storm—yet it is impossible to 
store sufficient backup water or divert water resources to maintain water-intensive operations in 
places such as hospitals, office buildings, chemical plants, generators, and manufacturing facilities. 
Unlike electricity, water cannot easily be re-routed around disruptions, nor can facilities generate 
backup water onsite to maintain critical operations. 

B. AGING INFRASTRUCTURE, CYBER DEPENDENCY, 
AND SEVERE WEATHER THREATS 


Each water and wastewater owner and operator manages a unique set of assets and a distinct risk 
profile. Specific risks and risk-management priorities depend on utility size, location, assets and 
distinct risk profile. The following discusses three of the most significant, common risks faced by 
water and wastewater utilities. 


DETERIORATING INFRASTRUCTURE IN A LIMITED-RESOURCE 
ENVIRONMENT 

With the Nation's infrastructure suffering from chronic underinvestment, system failures and service 
shortfalls are becoming distressingly common. While this study focuses on the resilience of systems 
under stressed conditions, it does so with the understanding that improvements in resilience must 
go hand-in-hand with improvements to ensure consistent service under nonstressed conditions. 
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BY THE NUMBERS: AGING WATER INFRASTRUCTURE & INVESTMENT GAPS 


Inadequate capacity in wastewater systems creates as many as 75,000 sanitary sewer overflows 
per year, discharging 3 billion -10 billion gallons of untreated wastewater and leading to as many 
as 5,500 different types of illnesses (EPA, Impacts and Control ofCSOs and SSOs, 2004). 

Degrading assets contribute to an estimated 240,000 water main breaks per year in the United 
States, a number that is likely to increase over the next 30 years (ASCE, "Drinking Water," 2013 
Report Card, 2013). 

Water infrastructure investment is not keeping up with the escalating need, creating an 

investment gap that is expected to reach $105 billion by 2025 and continue growing over the 
coming decades (ASCE, Failure to Act, 2016). 

The EPA estimates that $384 billion is needed to make necessary improvements for drinking 
water infrastructure between 2011 and 2030 (EPA, Drinking Water Infrastructure Needs Survey 
and Assessment, 2013). 

The EPA estimates that approximately $271 billion is needed to maintain and improve the 

Nation's wastewater infrastructure within the next five years (EPA, "EPA Survey Shows $271 
Billion Needed for Nation's Wastewater Infrastructure," 2016). 

The American Water Works Association (AWWA) estimates it will cost $1 trillion over the next 25 
years simply to maintain current levels of water service (AWWA, Buried No Longer, 2011). 


The risks posed by systemic underinvestment in water infrastructure are being intensified by 


increasing vulnerability to extreme-weather events, cybersecurity challenges, and other threats. 


Current practice is often to patch and repair as incidents 
happen, at the expense of smart investment in resilient 
systems that has the potential to improve service at a cost 
below current practice. 

Aging infrastructure and limited resources for adequate 
response planning and resilience investments are inextricably 
linked, creating a complex risk. Much of the water 
infrastructure has or is approaching the age at which it needs 
to be replaced. For both drinking and wastewater systems, 
the useful life of component parts ranges from 15 to 95 years 
depending on the component and its materials. For example, 
mechanical and electrical components in treatment plants 
and pumping stations have an average useful life of 15 to 25 
years while the concrete structures of treatment plants and 
pumping stations average 60 to 70 years for drinking water 
and 50 years for wastewater. 34 Wastewater mains have an 
average useful life of 25 years while drinking water trunk 
mains have an average useful life of 65 to 95 years. 35 


• • The impacts from having aging 
infrastructure are substantial and 
without action they will become critical. 
Because most of this infrastructure is 
out of sight and because many fine 
professionals work every day to keep it 
operating under difficult conditions, the 
full extent of the challenge we face is 
generally not understood by 
government officials, businesses, and the 
public.” 

Dr. Gerald E. Galloway, PE, Martin Institute 
Professor of Engineering at the University 
of Maryland; July 25,2013 statement to 
the U.S. Senate Committee on Energy and 
Natural Resources, Subcommittee on 
Water and Power 


34 ASCE, Failure to Act, 2011. 

35 Ibid. 
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Addressing this risk requires a massive investment in infrastructure. Estimates vary based on 
assumptions, time frames, and other factors; but it could cost several hundred billion dollars to as 
much as $1 trillion to address the Nation's infrastructure needs and maintain current levels of 
service. 36 Exhibit 111-4 presents the American Society of Civil Engineers (ASCE) assessment of the 
sector's investments needs, specifically the gap between total need and the amount that is funded. 

Exhibit 111-4. Estimated Investment Gap for Water and Wastewater Infrastructure by ASCE 37 


Expected Wastewater Treatment and Drinking Water Infrastructure 
Needs and Investments in the U.S., 2011, 2020, and 2040 

(billions of 2010 dollars) 


Wastewater Treatment 

201 I 

2020 

2040 

Drinking Water 

2011 

2020 

2040 



0 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 

I Funded Unfunded 


SOPHISTICATED CYBER THREATS REQUIRE ADVANCED 
SOLUTIONS AND SPECIALIZED EXPERTISE 

Water utilities increasingly use industrial control systems to continuously control treatment 
processes and delivery, remotely monitor operations, and control the pressure and flows in 
pipelines. These automated systems allow small teams of operators to efficiently and remotely 
manage complex physical processes using digital controls. Growing reliance on industrial control 
systems over the last decade has resulted in increased connectivity, a proliferation of cyber access 
points, escalating system complexity, and wider use of common operating systems and platforms— 
factors that increase cyber risk and require sophisticated cyber protections. 38 

Similar to companies in every sector, water utilities must protect their email, business systems, and 
billing systems from cyberattacks to protect sensitive business and customer data. Yet cybersecurity 
is even more imperative for the Water Sector's process control systems; a successful intrusion could 


36 AWWA, Buried No Longer, 2011. 

37 Chart recreated from ASCE, Failure to Act, 2011. 

38 Water SCC Cyber Security Working Group, Roadmap to Secure Control Systems in the Water Sector, 2008. 
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allow malicious actors to manipulate or disrupt water treatment and services, damage equipment, 
and compromise the safety of the water supply. 39 Attacks involving process control and monitoring 
systems could risk customer health and erode public trust in the water system. 

These threats are no longer hypothetical. Hackers recently hijacked a water treatment plant's 
industrial control system and modified the levels of chemicals being used to treat water. In a March 
2016 report, Verizon Security Solutions reported that it was investigating a data breach for an 
undisclosed water treatment facility, when it discovered that hackers who breached the payment 
system were also able to manipulate the controllers that manage the amount of chemicals used to 
treat the water supply. 40 The hack disrupted water treatment but did not affect the safety of the 
water—though it provided insight into the type of damage a more experienced or targeted hack 
could inflict. System knowledge also makes insider threats particularly insidious. For example, in 
2001, a disgruntled ex-employee of an Australia software vendor hacked into a wastewater 
treatment plant and released 264,000 gallons of raw sewage into local rivers and parks. 41 

Cyber threats are not one dimensional; vulnerabilities stem from personnel, processes, and 
technology. As cyber threats grow and evolve, utilities will require broad-based knowledge and 
tools, and most importantly, experienced personnel to understand cyber threats and apply new 
processes, technologies, and best practices to secure cyber systems. 


THE MANY DIMENSIONS OF THE CYBER THREAT 


Industrial control systems monitor and control highly distributed physical processes, including 
remote control of often unmanned facilities. Utilities require the tools and expertise to rapidly 
detect and recognize cyberattacks. 

Cyber and physical security is intimately linked. A cyber intrusion could give a hacker the ability to 
manipulate physical processes (such as chemical treatment and water flows), while insufficient 
physical security (such as an unsecured control room door) could give an individual unauthorized 
access to critical cyber controls. 

Utilities primarily rely on hardware and software vendors to develop secure control systems and 
patch vulnerabilities. Utilities need a strong understanding of cybersecurity requirements to 
procure secure technologies. 

Spearfishing attacks that aim to obtain operator credentials are a key threat. With the right 
credentials, even an inexperienced hacker can cause disruption or damage. Disgruntled 
employees with control system access also pose a threat. 

Increasing reliance on automated systems and growing sophistication of cyber threats requires a 
large increase in resources for staff training, cybersecurity advances, and knowledge acquisition. 

Smaller utilities often lack the resources and specialized personnel needed for cybersecurity 
improvements. For example, larger facilities may have the resources to maintain a separate, 
more-secure system for operational systems. This is rare in smaller utilities. 


39 Ibid; and DHS OCIA, Sector Risk Snapshots, 2014. 

40 Verizon Security Solutions, Data Breach Digest: The Usual Suspects, 2016. 

41 Godwin, "Water and Wastewater Cybersecurity," 2015. 
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NATURAL DISASTERS AND INCREASINGLY SEVERE WEATHER 
PATTERNS 

Natural disaster can harm water quality, limit service availability, and damage infrastructure. Floods, 
hurricanes, earthquakes, and ice storms are of particular concern for water utilities, but the sector 
has centuries of experience managing such risks. 42 

The increased intensity and frequency of severe weather (e.g., major flooding) patterns linked to 
climate change threatens drinking water and wastewater infrastructure. 43 For example, most water 
facilities are located near bodies of water. Expected climate change impacts are sea level rise and 
higher storm surge, which can flood facilities, damaging equipment and halting operations. To 
prepare for this, facilities may need to move crucial equipment above expected flood levels. 
Increasing precipitation and drought can also degrade water quality, resulting in increased 
treatment needs to meet requirements. 44 

Black Sky Events 

The Water Sector has a remarkable track record of 
maintaining water and wastewater services service 
during distressed conditions and minimizing the impact 
of disruptions that range from a few hours to a few 
weeks. The public is often unaware of the "near 
misses" that the sector has skillfully avoided. 

Disruptions are usually confined to local areas, but in 
rare cases—such as Superstorm Sandy—rise to a 
national-level event. But experts are predicting that far 
more serious incidents could take place in the near 
future. Often referred to as "black sky events," these 
high-impact, uncertain probability events could cause a 
combination of severe physical damage to 
infrastructure and widespread, long-duration power 
outages lasting months or even years. Without power, 
water service cannot be provided. 

Examples of potential black sky events, include: 

An earthquake in the New Madrid Fault Zone, which could cause extensive damage within 
200 miles of the epicenter. A New Madrid earthquake was one of the five disruption 
scenarios the Study Group evaluated to assess Water Sector resilience during a high-impact 
event. (See Appendix C. Disruption Scenario Case Study for more details on the five 
disruption scenarios). 


® • If we look at the experience of the 
Water Sector during Superstorm Sandy, 
the sector by and large did a terrific job 
of sustaining services. But a number of 
them were on the knife’s edge of failure 
due to problems in the resupply of 
diesel fuel for stand-by generators, the 
burning out of generators and the 
scarcity of replacement spares, and 
other factors. I’m concerned that 
longer duration, wide area power 
outages in a black sky event would push 
us over that knife’s edge and lead to 
serious disruptions in water and 
wastewater service.” 

Dr. Paul Stockton, Managing Director of 
Sonecon, LLC, and former Assistant 
Secretary of Defense for Homeland 
Defense 


42 EPA, 2015 SSP, 2016. 

43 EPA, "Climate Change: Basic Information," 2016. 

44 NACWA and AMWA, Confronting Climate Change. 2009. 


NIAC Water Sector Resilience Final Report and Recommendations 


25 




High-magnitude earthquakes in sections of the San Andreas Fault, which experts indicate 
are overdue. 45 In 2008, the U.S. Geologic Survey examined the consequences of a major 
earthquake along this fault line in southern California. Despite the State's mitigation efforts, 
pipes that cross the fault line would be damaged or broken. In addition, due to the large 
area affected, there would not be enough replacement materials and pipes or people 
trained to install them quickly. It could take several weeks to up to six months to complete 
repairs and reestablish normal water and wastewater service. Recreating the water system 
may be necessary in the hardest hit areas, and for some pipelines, equipment and 
electronics, repairs could take up to five years to complete. The estimated cost to repair the 
water and sewer lines is $1 billion. 46 

An extreme geomagnetic storm could also have widespread impacts that cross State lines 
and cause severe damage to transformers and other electrical equipment. A 2013 report by 
Lloyd's and Atmospheric and Environmental Research found that the greatest risk of this 
type of event is along the coast between Washington, D.C. and New York City, and that 
areas of the Gulf Coast and Midwest are also at high risk. The expected duration of the 
power outages could range from 16 days to up to two years depending on the availability of 
replacement electrical transformers. 47 The associated loss of water service can be expected 
to be of similar severity. 


45 Lin, "San Andreas Fault,"' 2016; and Jones, et al.. The ShakeOut Scenario, 2008. 

46 Jones, etal., The ShakeOut Scenario, 2008. 

47 Lloyd's and Atmospheric and Environmental Research, Inc., Solar Storm Risk, 2013. 
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WHEN INFRASTRUCTURES FAIL 


Major infrastructure failures often expose the true value of the safe, reliable service we expect from our 
critical sectors. The examples below illustrate how serious infrastructure failures—in transit, electricity, 
and drinking water-can have severe near- and long-term consequences, regardless of the cause. 

Minneapolis Bridge Collapse: On August 1, 2007, the I-35W Bridge in Minneapolis, Minnesota 
suffered a catastrophic failure and collapsed into the Mississippi River, killing 13 people and injuring 
145 people. The bridge carried more than 140,000 vehicles each day and provided access to 
downtown Minneapolis, the University of Minnesota, and businesses. The economic impact for drivers 
that used the bridge was $400,000 per day. For the State, the loss of the bridge resulted in economic 
impacts of about $17 million in 2007 and $43 million in 2008 (NTSB, Collapse ofl-35W Highway Bridge, 
2008; Minnesota DEED and Mn/DOT, Economic Impacts of the I-35W Bridge Collapse, n.d.; Jones, "Friday Marks 7 
years since I-35W Bridge Collapse," 2014). 

Superstorm Sandy: Hurricane Sandy made landfall on Oct. 29, 2012 near Atlantic City, New Jersey as a 
post-tropical cyclone with heavy rains, 80-90 mph winds, and storm surges along the East Coast. One 
week later a Nor'easter swept into the affected region with strong winds, rain and snow, and coastal 
flooding, giving Sandy the "superstorm" moniker. In New Jersey, more than 200 million gallons of 
water from the tidal surge engulfed one of the largest wastewater treatment plants in the United 
States, operated by the Passaic Valley Sewerage Commission. The 152-acre plant stood in four feet of 
water (with 15—30 feet of flooding in underground systems), sustained damage to critical machinery 
and lost power for three days. Extensive dewatering of sewage sludge and critical repairs to bring the 
plant back to operation cost an estimated $200 million—about $50 million more than the 
commission's total annual operating budget (NIAC, Regional Resilience, 2013). 

2003 Northeast Blackout: On August 14, 2003, a confluence of events triggered a cascading electric 
transmission failure that caused a blackout across Ohio, Michigan, Pennsylvania, New York, Vermont, 
Massachusetts, Connecticut, New Jersey, and the Canadian province of Ontario. The blackout lasted 
up to four days in some locations, left 50 million people without power, contributed to at least 11 
deaths, and cost $4 billion—$6 billion. The U.S.-Canada Power System Outage Task Force found that 
the blackout was caused by deficiencies in corporate policies, lack of adherence to industry policies, 
and inadequate management of reactive power and voltage (Minkel "The 2003 Northeast Blackout- 
Five Years Later," 2008; U.S.-Canada Power System Outage Task Force, Final Report on the August 14, 
2003 Blackout, 2004). 

Flint Water Contamination Crisis: In April 2014, the water source serving the City of Flint, Michigan — 
with a population of 99,000 people—was switched from Lake Huron (treated by Detroit Water and 
Sewerage Department) to the Flint River (treated by the Flint Water Treatment Plant). The more 
corrosive Flint River water required corrosion-control treatment, but it was not put in place when the 
switch occurred. The untreated water corroded the lead feeder pipes that connect homes to the 
underground water mains, causing lead to leach into the drinking water. The Flint Water Advisory Task 
Force found that a mismanagement of the drinking water supply caused Flint water customers to be 
exposed to toxic levels of lead and other hazards. Appendix H. The Flint Water Crisis provides a 
detailed examination of this failure of water services (Flint Water Advisory Task Force, Final Report, 
2016; Adams, "Closing the valve on history," 2014; Edwards, "Test Update: Flint River water 19X more 
corrosive," 2015). 
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IV. WATER INFRASTRUCTURE RESILIENCE 
TODAY 


Chronic underinvestment, system failures, and service shortfalls are becoming increasingly common 
in the Nation's infrastructure. Though this study focuses primarily on the resilience of systems under 
highly stressed conditions, resilience improvements must go hand-in-hand with strategies and 
practices to ensure reliable operations under normal, nonstressed conditions. There is a broad body 
of knowledge available today—principally from water associations—on resilience strategy and 
practices for water utilities. Translating resilience knowledge into widespread practice, however, is 
often limited by resource constraints and funding challenges that require innovative strategies and 
collaborative approaches to address. This Chapter reviews the current state of practices, major 
challenges to raising resilience in the sector, and key indicators of progress. 

A. CURRENT PRACTICE 


Each water and wastewater owner and operator manages a unique set of assets and operates under 
a distinct risk profile. As such, each utility's risk-management priorities depend on many factors, 
including utility size, location, assets, distinct risks, and perhaps most importantly, the resources and 
capabilities the utility can access. 48 Some serve growing populations with increasing resources, while 
others serve shrinking populations with declining tax bases that must maintain systems, which are 
now oversized for the population they serve. While each utility is responsible for its own risk 
management, sector-wide collaboration and information sharing plays a major role in boosting the 
resilience of individual systems and the sector as a whole. 

Key aspects of resilience practices in the sector are outlined below; Appendix G. Baseline Resilience 
in the Water Sector provides a more extensive review of the sector's components, risks, and 
practices. 

HIGHLY DIVERSE RESOURCES AND CAPABILITIES 

Water and wastewater utilities are quite diverse; some develop and implement leading-edge 
practices while others lack access to essential information, knowledge, expertise, tools, and lessons 
learned. Despite the value of these resources among water utilities, adoption of successful practices 
and resources has not been fully realized across the sector. The adequacy of human capital within 
the Water Sector is a growing concern, particularly with regard to knowledge retention and talent 
acquisition. Challenges that require new skill sets and training—such as cybersecurity—constrain the 
ability of utilities to adapt to a changing environment. The loss of institutional knowledge due to 
retirements compounds this shortfall. 

The relatively few very large systems in the Water Sector that serve the majority of the Nation's 
population —about 20 percent of water and wastewater systems serve more than 90 percent of the 
population—tend to have comparatively strong resilience measures in place. Smaller systems do not 


48 Water SCC, "Charter of the Water Sector Coordinating Council," 2014; and CIPAC Water Sector Strategic 
Priorities Working Group, Roadmap to a Secure and Resilient Water Sector, 2013. 
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enjoy the same level of resources, and must rely on the transfer of knowledge and tools from other 
experts. Associations representing components of the Water Sector, aided by DHS and EPA, have 
been very active in developing and disseminating models, tools, and best practices, which are 
transferable to smaller systems. The 2015 Water SSP includes many examples of this resilience¬ 
building approach. 49 

UTILITY RESPONSE CONSTRAINED BY SIZE AND RESOURCES 

The Water Sector is adept at maintaining water services during short-term disruptions, such as a 
power outage lasting less than 24 hours. Beyond that time frame, the ability to maintain services 
depends largely on the size of the system, its location, and access to resources. For example, large 
utilities in a metropolitan region may have more robust backup and contingency resources, and 
depending on their location may have more options that allow them to "fail gracefully," such as 
access to mobile generators, access to nearby water utilities in the region that can provide aid, or 
relationships with other critical infrastructure partners that can share resources. 

Exhibit IV-1 is a conceptual graph that shows how degradation of services can differ between large 
and small utilities. Larger utilities often are more equipped to handle power outages or other 
disruptions to critical infrastructure for several days or longer. But when disruptions stretch out into 
weeks or months, all systems—regardless of size—will need help maintaining services. 

Exhibit IV-1. Conceptual Degradation Curve between Large and Small Utilities during Disruptions 



49 EPA, 2015 SSP, 2016. Appendix 6, Table A6-1, pp. 47-49. 
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FEDERAL INVOLVEMENT 

The Water Sector is facing a dynamic and complex risk environment in which the full impacts of 
water disruptions and potential cascading impacts are not fully understood among critical 
infrastructure operators, local and State leaders, and water service customers. As such, the history 
of major disruptions show that water and wastewater services are receiving inadequate attention in 
disaster planning, prevention, and response among public officials and interdependent sectors. The 
lack of widespread, cross-jurisdictional collaboration can lead to stovepiped decision-making that is 
counterproductive to effective emergency response. 

As noted in Chapter II. Water Sector Operational Snapshot, the Federal Government's role in the 
Water Sector is primarily focused on water quality (EPA) and emergency response and recovery 
(FEMA). Resilience has not been substantially integrated into the actions of Federal agencies and 
resilient outcomes are not typically part of Federal programs and resources. In contrast to the 
Energy and Transportation Sector, the Water Sector does not have a cabinet-level department and 
there is no dedicated Emergency Support Function (ESF) for water. 

Current authority for water is distributed across four ESFs and multiple Federal agencies, leading to 
uncertainty, leadership challenges, information-sharing complications, and an overtaxing of Water 
Sector response resources—all of which can impede water service recovery during disasters. In 
contrast, the Energy Sector has a dedicated ESF. In our 2009 report, Framework for Dealing with 
Disasters and Related Interdependencies, the Council recommended that the Water Sector should 
be elevated to an ESF within the National Response Framework (NRF) during the next revision 
cycle. 50 Despite the fact that the NRF was revised and released in 2013; the Water Sector remains 
disbursed across four different ESFs. 51 


EMERGENCY SUPPORT FUNCTION (ESF) AND THE WATER SECTOR 


ESFs provide the structure for coordinating interagency support in response to an 
incident. They are mechanisms for grouping common disaster response functions, with each ESF 
composed of multiple agencies performing similar functions as a single, cohesive unit. There are 15 
different ESFs designed to improve emergency management and response. 52 

What is the relationship between ESF and the Water Sector? Responsibilities for emergency water 
service support is disbursed across four different ESFs: ESF 3 (Public Works and Engineering), ESF 4 
(Firefighting), ESF 6 (Mass Care, Emergency Assistance, Flousing, and Fluman Services), and ESF 8 (Public 
Health and Medical Services). Essentially, water and wastewater services are a subordinate function 
under four different ESFs, with each ESF having a different ESF Coordinator/Primary Agency responsible 
for that function. Under this design, water agencies do not have sufficient visibility with function 
leadership or the resources to support four different ESFs during an emergency. 53 


Water Sector 

ESF structure disbursed across 4 different ESFs 


Energy Sector 

Dedicated ESF structure, ESF #12 


50 NIAC, Framework for Dealing with Disasters and Related Interdependencies, 2009. 

51 FEMA, National Response Framework, 2013. 

52 FEMA, Emergency Support Function Annexes, 2008. 

53 NIAC, Framework for Dealing with Disasters and Related Interdependencies, 2009. 
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COLLABORATION IN PLANNING 

The Critical Infrastructure Partnership Advisory Council (CIPAC) Water Sector Strategic Priorities 
Working Group developed the 2013 Roadmap to a Secure & Resilient Water Sector (2013 Roadmap) 
to prioritize activities to strengthen sector security and resilience. The 2013 Roadmap identified 
three top priorities for the Water Sector over the next five years: 1) advance the development of 
sector-specific cybersecurity resources; 2) raise awareness of the Water Sector as a lifeline sector 
and recognize the priority status of its needs and capabilities, and 3) support the development and 
deployment of tools, training, and other assistance to enhance preparedness and resilience. 54 

These priorities are currently being used by public-private partners in the Water Sector to focus on 
activities in a two- to five-year timeframe that can strengthen the sector's ability to plan for 
effective response and recovery, maintain resilience during a calamitous event, and garner support 
for both disaster and risk-mitigation cost recovery. 

INFORMATION SHARING TO SUPPORT RESILIENCE 

Information sharing plays an essential role in the security and resilience of the Water Sector. There 
are several key information-sharing methods extensively used in the sector. Associations play a 
fundamentally critical role in knowledge development and transfer, as well as in developing 
practices to share multiple types of resources during disasters. One of the most well-known and 
utilized mechanisms is the Water/Wastewater Agency Response Network (WARN), which is active in 
all 10 FEMA regions and Canada. In addition to providing mutual aid and assistance, WARN provides 
valuable after-action reports, such as the WARN Superstorm Sandy After-Action Report. 

The Water Information Sharing and Analysis Center (WaterlSAC) serves as an information-sharing 
arm of the sector. Members include hundreds of utilities serving more than 200 million people in 
the United States, as well as Federal, State, and local agencies and consulting firms. 55 


WARN: WATER UTILITIES HELPING WATER UTILITIES 


The Water Sector is designated a lifeline critical infrastructure sector, meaning that other sectors depend 
on it to recover after a major disruption. Bringing disrupted water utilities back online to mitigate further 
disruption to other sectors and the community is a priority mission. To assist in this mission, AWWA led 
the creation of the Water and Wastewater Agency Response Network (WARN). 

WARN is a network of utilities helping other utilities to respond and recovery from disruptions. 
Participating utilities can provide and receive emergency assistance (personnel, equipment, materials, and 
other critical services), as necessary, from other water or wastewater utilities. Mutual aid networks like 
WARN enable water utilities to: 

Secure sector-specific resources to quickly respond/recover from a disaster; and 

Build relationships with similar or nearby utilities that can be leveraged during preparedness, 

response, or recovery. 


54 CIPAC Water Sector Strategic Priorities Working Group, Roadmap to a Secure and Resilient Water Sector, 
2013. 

55 National Council of ISACs, "Join Your Sector's Information Sharing and Analysis Center," 2015 
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B. CHALLENGES 


Developing and sustaining effective risk-management practices comes with a broad range of 
challenges. While the challenges may vary according to a utility's size, resource base, and experience 
in risk management, the following challenges reflect common and critical challenges for water and 
wastewater utilities: 

• A Difficult Starting Point. The Nation's water infrastructure is aging and needs 

reinvestment. Although there are certainly exceptions, too many systems are old, fragile, 
and have served well beyond their planned life spans. Restoring the long-term viability of 
these systems will be difficult—just to meet the demands of nonstressed conditions. 

Support for Water as a Public Good. Water services exist in a quasi-public-service world. 
While often considered a public good, they are nonetheless generally operated on a basis 
that does not account for the full life-cycle costs of systems. Inequities among wealthy and 
poor communities can exacerbate the affordability of clean water and create social justice 
concerns. A public good requires public investment. 

Backing Solutions with Decisions. An extensive array of knowledge, tools, and potential 
solutions has been developed by Water Sector professionals—in individual utilities and in 
professional associations. However, widespread improvement in resilience can only be 
achieved by adoption and funding of these potential improvements by decision-makers. 

Enabling New Approaches. Most State and municipal decision-makers are constrained by 
the long-held expectations by customers for water as a low-cost, affordable service that 
does not account for true life-cycle costs. This is particularly challenging in low-income areas 
with a shrinking tax base and limited economic opportunities. Political reluctance to opt for 
new technology, funding, and investment approaches -which may substantially differ from 
traditional ones and may constrain progress. With new challenges, the need for and value of 
new approaches must be understood. 

Partnership and Champions. The Federal Government involvement with services that are 
primarily delivered at the local level is understandably constrained. However, the 
government can assist by providing invigorated leadership with guidance, resources, 
incentives, and innovative approaches that leverage infrastructure investments into jobs. 
The challenge is simply too large for States and municipalities to go it alone. 

C. INDICATORS OF PROGRESS 


A number of concerted efforts by Water Sector partners have made progress in achieving the shared 
vision of a secure and resilient drinking water and wastewater infrastructure. This infrastructure 
provides clean and safe water as an integral part of daily life and ensures the economic vitality of 
and public confidence in the Nation's drinking water and wastewater service. Enhanced 
collaboration has yielded advances in areas such as the improved sharing of resources; the 
expanded use of new tools, knowledge, and training; and improved characterization of emerging 
threats, such as cyber intrusions and extreme-weather events. 
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Several examples of these collaborative successes are presented in Exhibit IV-2 and highlight both 
the critical role played by associations and the collaborative nature of successful endeavors. 
Appendix I. Collaborative Tools and Practices presents additional examples. 

Exhibit IV-2. Examples of Collaborative Efforts for Improving Water Sector Resilience 


RISK AND RESILIENCE MANAGEMENT OF WATER AND WASTEWATER SYSTEMS 


AWWA developed standard J100-10 (R13), the first voluntary consensus standard encompassing 
an all-hazards risk and resilience management process for use specifically by water and 
wastewater utilities. It is a foundational, consensus-based standard that encompasses an all¬ 
hazards risk and resilience management process for use specifically by water and wastewater 
utilities. 56 


CIPAC WATER SECTOR CYBERSECURITY STRATEGY WORKGROUP: FINAL 
REPORT & RECOMMENDATIONS 


The report recommends approaches to outreach and training to promote the use of the National 
Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure 
Cybersecurity; identifies gaps in available guidance, tools, and resources for addressing this 
framework in the sector; and identifies measures of success that can be used by Federal agencies 
to indicate the extent of use of the framework in the Water Sector. 57 


ROADMAP TO A SECURE & RESILIENT WATER SECTOR 


Developed by the CIPAC Water Sector Strategic Priorities Working Group, the roadmap 
establishes a strategic framework that articulates the priorities of industry and government in the 
Water Sector to manage and reduce risk. It also produces an actionable path forward for the 
Water Sector GCC, SCC, and government and private sector security partners in the sector to 
improve the sector's security and resilience within the next five years. 58 


CYBERSECURITY GUIDANCE & TOOL 


Based on recommendations in the 2008 Roadmap to Secure Control Systems in the Water Sector, 
AWWA's Water Utility Council developed a cybersecurity resource designed to provide 
actionable information for utility owner/operators based on their use of process control systems. 
The Use-Case Tool provides the foundation of a voluntary, sector-specific approach for adopting 
the NIST Cybersecurity Framework, created in response to Executive Order 13636 - Improving 
Critical Infrastructure Cybersecurity. 59 


EPA WATER INFRASTRUCTURE AND RESILIENCY FINANCE CENTER 


In January 2015, EPA launched the Water Infrastructure and Resiliency Finance Center, which 
supports the government-wide Build America Investment Initiative. The center provides 
communities, municipal utilities, and private entities with information and technical assistance 
on how to effectively use existing Federal funding programs, access leading-edge financing 


56 AWWA, A l/l/l/l/A J100-10 (R13) Risk and Resilience Management of Water and Wastewater Systems, 2010. 

57 CIPAC Water Sector Cybersecurity Strategy Workgroup, Final Report and Recommendations, 2015; and NIST, 
Framework for Improving Critical Infrastructure Cybersecurity, 2014. 

5S CIPAC Water Sector Strategic Priorities Working Group, Roadmap to a Secure and Resilient Water Sector, 
2013. 

59 AWWA, "Cybersecurity Guidance & Tool;" and AWWA, Process Control System Security Guidance for the 
Water Sector, 2014. 
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solutions, and develop innovative procurement and partnership strategies. Although relatively 
new, the center has already undertaken several initiatives including establishing a network of 
university-based Environmental Finance Centers that correspond to the 10 EPA Regions; hosting 
Regional Finance Forums to bring together municipal officials and interested stakeholders to 
facilitate peer-to-peer interactions, share best practices, and build relationships; and providing 
technical assistance and tools through its Community Assistance for Resiliency and Excellence 
(WaterCARE) program. The center, which is advised by EPA's Environmental Financial Advisory 
Board, also works closely with other Federal partners. 60 


TRANSFORMING COMMUNITIES THROUGH SUSTAINABLE 
INFRASTRUCTURE INVESTMENTS 


Leading organizations are rethinking how investment in resilient infrastructure can be leveraged 
to create new opportunities to reinvigorate communities, increase inclusion, and stimulate local 
business investment. The San Francisco Public Utilities Commission (SFPUC) has created a 
Community Benefits Program that engages neighborhoods that are directly affected by the 
operation of its water, wastewater, and power enterprises. The program includes education, 
workforce development, economic development, land use, neighborhood revitalization, funding 
for the arts, localized professional services contracts, and philanthropic partnerships. SFPUC 
seeks to balance economic, environmental, and social equity goals to expand economic inclusion, 
create job opportunities, revitalize low-income neighborhoods and support climate change 
priorities. 61 

In the Transportation Sector, Secretary of Transportation Anthony Foxx recently issued a letter 
that encourages grantees and stakeholders to take advantage of opportunities to leverage $305 
billion in Fixing America's Surface Transportation (FAST) Act funding to create new jobs, pointing 
out that every $1 billion invested in Federal highway and transit infrastructure would support 
13,000 jobs. A new pilot program, for example, enables recipients of Federal highway and transit 
funds to use innovative contracting requirements designed to create jobs that may have 
traditionally been disallowed due to competition concerns. Another approach, the U.S. 
Employment Plan developed by the Jobs to Move America Coalition, contains a contractual 
provision that provides incentives for companies to create American jobs, locate facilities in the 
United States, and generate opportunities for unemployed workers through recruiting and 
training efforts. 62 

In essence, there is a great deal of information about the mechanics to solve the problem—what to 
do, how to do it, and who to work with—this is only the start of a solution. The political challenge, 
which spans the spectrum from developing public understanding to the willingness of elected 
officials to opt for investment, is daunting. The mechanics of a solution may well be easier than 
obtaining political will. 


60 EPA, "About the Water Infrastructure and Resiliency Finance Center," 2016. 

61 SFPUC, "Community Benefits Program," 2013. 

62 Office of the Secretary of Transportation, "Letter to Transportation Stakeholders," 2016. 
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V. FINDINGS AND RECOMMENDATIONS 


The Water Sector is a lifeline sector that is critical to the core operations of other sectors and 
essential to human health and daily life. The Water Sector faces a unique set of challenges due to 
services being historically reliable and low-cost, and out of sight of the public and decision-makers. 

A. FINDINGS 


Through interviews with Federal agency representatives and subject matter experts, extensive 
research, and the work of the Study Group, the Working Group identified six areas of findings that 
encompass the challenges, needs, and strategies for improving security and resilience within the 
Water Sector: 

1. Poor Understanding of the Criticality of the Water Sector 

2. Inadequate Valuation of Water Services 

3. Wide Disparity of Capabilities and Resources 

4. Significant Underinvestment in Water Sector Resilience 

5. Fragmented and Weak Federal Support for Water Resilience 

6. Regional Collaboration Not Broadly Applied 

The findings highlight the criticality of water, the need to address emerging risks, and the significant 
challenge of funding needed improvements to water and wastewater infrastructure. 

Finding I: Water is not given appropriately high priority as a critical lifeline sector 
by public officials and dependent sectors during disaster planning, prevention, and 
response. 

The Water Sector is facing a changing and complex risk environment, and critical infrastructure 
operations, State and local leaders, and customers often do not understand the full impacts of 
water service disruptions, including the potential cascading impacts of extended disruptions. As 
a result, the Water Sector may not receive the high priority it deserves to perform emergency 
restoration. For example, water utility employees often lack priority access to damaged assets 
during a disaster due to a misunderstanding of the steps needed to fully repair water systems 
and the time sensitivity of operational recovery in the sector. 

Under the National Response Framework, water responsibilities are distributed across 
four Emergency Support Functions (ESFs) and multiple Federal agencies. This can result in 
water being excluded from unified command or interagency coordination, and can create 
confusion during response and recovery efforts that can impede water service recovery 
during disaster. 

1.2. Water and wastewater utilities rely on electricity for operations, fuel for backup power 
and transportation, and chemicals for water treatment. While these dependencies are 
known to operators and emergency personnel, it is more difficult to track the changing 
risks within the interdependent sectors that supply critical products and services. These 
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dependencies and the associated risks are often not sufficiently addressed in practices, 
such as business continuity or response planning along supply chains or across dependent 
sectors. 

Finding 2: Water services are often undervalued and taken for granted because 
they are typically highly reliable, inexpensive, and hidden from view. 

This undervaluing makes it difficult to gain public support and necessary funding for 
infrastructure improvements, upgrades, repairs, and maintenance that would increase resilience 
and maintain the sector's excellent track record. 

A significant portion of the infrastructure includes underground pipes and other assets 
that are invisible to the public eye. This location can mask the need for significant repairs, 
replacements, and upgrades as the infrastructure ages. Public perception of water 
infrastructure condition may not match the backlog of needed maintenance on many 
systems. 

2.2 There are very few high-profile examples of major water infrastructure failures. As a 
result, weak public understanding and recognition of the critical nature of water services 
makes it difficult for public officials and decision-makers to justify the time and money 
required to make repairs following an incident, as well as fund key infrastructure 
improvements. 

2.3 It is difficult for public officials to gain support to increase rates or allocate public funds for 
short- and long-term water infrastructure projects, particularly if disadvantaged or low- 
income populations would be harmed by rising water prices. 

2.4 Investments in resilience can produce order-of-magnitude savings compared to 
expenditures for emergency response and repair. 

Finding 3: Technical capabilities and resources vary widely among water utilities. 
Smaller utilities in particular often lack the qualified staff, tools, technical expertise, 
and reliable information needed to manage new risks. 

An evolving risk environment requires utilities to prepare for a wide range of potential risks 
amidst day-to-day operations without loss of service levels. Such planning and preparation 
requires significant resources, including the technical and financial capability to manage long¬ 
term, risk-management decisions and “make the case" to decision-makers to address high- 
impact, low-frequency risks that must compete with other operational priorities. 

3.1 As water utilities—particularly those that are under-resourced—balance day-to-day 
operations with long-term, risk-management decisions, they may lack the capabilities to 
adapt to a range of uncertain threats, such as extreme-weather events and rising sea 
levels. Water utility planners lack reliable projections, guidelines, or design standards from 
Federal agencies that would enable them to design, build, and maintain resilient 
infrastructure. 

3.2 The increasing prevalence of cyber intrusions challenge business-as-usual practices for 
nearly all utilities. Strong cybersecurity awareness and practices among utility personnel is 
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often limited. The number of available Water Sector cyber experts is insufficient for 
current needs, and utilities are constrained in their ability to offer competitive hiring 
packages to attract top cybersecurity experts. 

3.3 It is difficult to maintain, recruit, and train qualified personnel due to specialized job 
requirements and competition for skilled workers, leading to a loss of institutional 
knowledge and skills. Many utilities are unable to invest in enough engineering resources 
to assess existing and future infrastructure needs. 

3.4 The technology, knowledge, and tools to promote resilience exist, but awareness of their 
availability and adoption does not appear to be spread widely throughout the sector, and 
knowledge transfer lags. 

Water and wastewater utilities are diverse in the advancement of their operations—some 
are developing and implementing leading-edge practices, while others lack the 
information, expertise, and tools to do so. 

Finding 4: There is significant, chronic underinvestment in water infrastructure and 
resilience due in part to widespread public ownership and a reluctance to raise 
rates. 

The estimated investment gap ranges from $400 billion to almost $1 trillion to maintain the 
current level of water service. The majority of Water Sector assets are publicly owned, making it 
difficult to gain approval for large infrastructure investments to improve resilience from the 
elected boards/commissions that set rates and approve capital projects. Without public support, 
it is difficult to create the political will necessary to fund forward-looking investments, especially 
if they increase the burden on low-income populations. 

Public resources are often available for immediate short-term needs, such as emergency 
response; but historic patterns of inadequate investment have delayed needed 
maintenance and inhibited long-term improvement projects. This has created frequently 
distressed conditions that threaten reliable operations outside of emergency events. 

Publicly owned utilities often use bonds to fund construction and rely on rate increases to 
recoup costs. The requirements for additional Federal or State funding to support an 
infrastructure project, such as State Revolving Funds, can make it difficult to access or use 
these sources. 

4.3 The challenge of maintaining affordability for all customers, including low-income or at- 
risk customers, can make it difficult for some water and wastewater systems to 
implement full cost-of-service pricing. 

Some publicly owned utilities do not adequately invest in pre-disaster mitigations because 
they believe that the Federal Government will provide significant resources to repair their 
system in the wake of a major disaster. 
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Finding 5: Resilience has not been substantially integrated into the actions of 
Federal agencies, and resilient outcomes are not part of Federal guidance and 
resources. 

The Federal agencies and departments that oversee the Water Sector, such as EPA and State 
primacy agencies, are primarily focused on public health and environmental protection 
measures, and resilience programs are often voluntary. 

5.1 Some Federal regulations inhibit utilities from taking steps to improve resilience or build in 
redundancy, such as building and operating cost-effective power generation or allowing 
for different water quality standards to be met during an emergency. 

Finding 6: Limited regional coordination across jurisdictions and water systems 
leads to inefficient, siloed decision-making that can hamper resilience. 

Although there are notable exceptions, water utilities within a region tend to plan and operate 
independently, leading to a lack of visibility and understanding of infrastructure system 
dependencies within metropolitan areas and regions. Multiple local and/or State jurisdictions 
tend to complicate cross-jurisdictional coordination and may cause utilities to react to an event 
independently without consideration for a regional, collaborative solution that would yield 
quicker and more cost-effective results. 

6.1 The lack of a broadly accepted framework for regional goals, resource-sharing criteria, and 
performance metrics hinders the development of a shared approach to disruption. The 
framework should apply to all phases of resilience, not just response. 

6.2 Water disruptions primarily affect local communities, but can have a significant impact on 
local and regional lifeline sectors. Insufficient attention is given to the risk and impact of a 
large-scale national disruption. 

The sector has made in-roads in this area through its Water/Wastewater Agency Response 
Network (WARN). The interstate, volunteer-based network provides mutual aid between 
member utilities following a disaster to aid in expedited restoration of services. 

B. RECOMMENDATIONS 


The Water Sector has made progress in the area of resilience by actively planning and collaborating 
on key efforts, such as the 2013 Roadmap to a Secure and Resilient and Water Sector and the CIPAC 
Water Sector Cybersecurity Strategy Workgroup: Final Report and Recommendations. But as the 
findings suggest, much more needs to be done. Marshalling political will and public support is a 
protracted process that requires communication, collaboration, and unfailing dedication: champions 
are needed at all levels of government. 

During each of our last two studies, the Council witnessed disasters that provided examples of how 
infrastructure can fail under stress. We witnessed the destruction brought by Superstorm Sandy and 
the 2012 derecho during our Regional Resilience study, and the effects of West Coast port 
shutdowns and winter storms that crippled the Boston transit system and caused a dangerous 
freight derailment in West Virginia during our Transportation Resilience study. The Flint water crisis 
that unfolded during our current study provided us with insights of how mismanagement, poor 
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governance, and infrastructure shortcomings can converge to wreak havoc on the daily lives of 
citizens of a small city. While our study is not focused on the Flint situation, we believe that our 
recommendations closely align with some of the underlying failings that led to the problems in Flint. 

The Council recommends the following steps be taken to improve resilience in the Water Sector. For 
each recommendation, we have identified specific actions that the Federal Government should take 
to ensure the success of these recommendations. Many of these recommendations have been 
presented in previous studies by the Council or other organizations. Appendix E. Compendium of 
Prior Recommendations provides a list of these recommendations most relevant to this study. 


Recommendation I: Analyze and map the complex risks of major water 
disruptions and develop mitigations. 


The Federal Government should assist owners and operators in the Water Sector to uncover 
emerging cross-sector risks and develop mitigations for disruptions that could cascade into 
other sectors and regions, particularly if they have the potential for national consequences. To 
accomplish this, the Federal Government should commit funding and expert resources to help 
identify, analyze, and map hidden risks that result from complex sector interdependencies, 
regional interconnections, and increased convergence of physical-cyber systems. 

Specific Actions 

The DHS National Protection and Programs Directorate (NPPD)—in coordination with EPA; 
DOE; DOT; U.S. Department of Health and Human Services (HHS); State, Local, Tribal, and 
Territorial Government Coordinating Council (SLTTGCC); and other Federal and State 
partners—should conduct joint tabletop exercises, across jurisdictions and interdependent 
sectors, to test the resilience of the water infrastructure during major incidents, such as 
cyberattacks and large-scale power outages. The joint exercise should be conducted within 
12 months of the release of this report. 

The Federal Government should identify existing user-friendly models that would help 
emergency managers and planners better understand systems and interdependencies at the 
metropolitan and regional level. The evaluation should identify best practices and data 
needed to improve existing models. The Federal agencies best positioned to improve and 
distribute models should work with the water associations on outreach and distribution of 
the models and best practices so they can be applied more broadly across the sector. 

Within one year, the Federal Government, in partnership with the Water Sector, should 
identify analytic tools, guidelines, and check lists for assessing cross-sector and cyber 
vulnerabilities to be part of a series of pilot projects at selected sites across the water 
infrastructure. The pilots should leverage existing tools and guidance, and the results of the 
pilots should be used to encourage the application of successful tools and best practices 
more broadly across the sector by providing decision-makers with the evidence and data 
they need to justify investments. 
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The Federal Government, working with the Water Sector, should identify analytic tools 
(including those for assessment of cross-sector vulnerabilities and dependencies); guidance 
for mitigation, and associated best practices (including those from other sectors) to provide 
water utilities with measureable, actionable information they need to prepare for emerging 
threats and risks, particularly as they make decisions related to planning and capital 
investments (e.g., hardening assets, protecting or building facilities). 


Recommendation 2. Fortify Water Sector response and recovery 
capabilities. 


The Water Sector has historically maintained continuity of service during events and provided 
rapid response and recovery despite obstacles. However, because of the criticality of water and 
wastewater services, the Federal Government should take immediate actions to formalize and 
improve the response and recovery capabilities at every level of the Water Sector. To 
accomplish this, the Federal Government should increase planning for extreme events, 
consolidate Federal response responsibilities, and increase funding for successful sector mutual 
aid efforts. 

Specific Actions 

The National Security Council (NSC) should direct the Water Sector and Government 
Coordinating Councils to create a government-industry playbook for managing extreme 
events. The playbook, which could be modeled after the Electricity Sector Coordinating 
Council Playbook, should clearly define the roles and responsibilities of agencies and utilities 
to help sustain operations during a severe event and help prioritize activities, such as 
providing fuel for emergency generators and re-supply of crucial chemicals. 

The Secretary of Homeland Security should direct the administrator of FEMA to consolidate 
Federal emergency response roles and responsibilities for water into a single ESF within the 
Annex to the National Response Framework. This would improve coordination and reduce 
confusion, improve information sharing and communication, and alleviate over-taxing of 
resources within the Water Sector. 

EPA should increase funding to expand the successful mutual aid program, WARN, to 
facilitate regional collaboration of events that extend across jurisdictions and reinforce the 
program as a successful model for addressing the full spectrum of resilience and physical 
and cyber asset challenges. 
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Recommendation 3. Increase Federal funding, investment, and incentives to 
improve water infrastructure resilience. 


A 


The Federal Government should establish new funding mechanisms, structures, and incentives 
to increase investment in resilience at the regional and local levels to counter historic 
underinvestment in infrastructure, and to remove obstacles that public agencies face in 
increasing rates, particularly when they impact low-income communities. 

Specific Actions: 

EPA, under existing or newly established authorities, should work with HHS to create a 
Federal financial assistance program (similar to the Low Income Home Energy Assistance 
Program) to reduce the financial burden on low-income communities from water rate 
increases and allow communities to make necessary infrastructure investments and set 
rates that reflect the true cost of providing services. To launch the financial assistance 
program, EPA should work with the major water associations to implement a pilot with five 
water utilities within 12 months of this report's release. 

Create a disaster deductible for allocating Stafford Act funding to incentivize communities to 
make investments to increase resilience. In recent years, the Federal Government has 
stepped in on numerous occasions following an event to provide post-disaster relief. This 
has created a moral hazard—communities are not investing in measures that could mitigate 
the impacts of a low-frequency, high-consequence event because they expect the post¬ 
disaster funds will be available, if needed. The 
effects of disasters often cross jurisdictions 
and impact entire regions; because of this, the 
deductible should have a regional focus. 

• The NSC, DHS, and FEMA should develop 
resilience criteria that takes into account 
the multiple factors that can affect 
investment by water utilities and 
recognizes utilities that provide mutual aid 
and support. 

• Mitigation and resilience actions would be 
credited toward a region's deductible. If 
they do not take certain steps, in the event 
of a disaster, there would be a certain 
amount of covered assistance that they 
would be responsible for paying. 

Identify and promote innovative financing options that fast track and streamline 
investments in water infrastructure and resilience, including public-private partnerships and 
century bonds; new or expanded use of the State Revolving Funds, as recommended by the 
Environmental Financial Advisory Board; or new ways to leverage other Federal grant 
programs, such as those available through the U.S. Department of Housing and Urban 



® • For publicly-owned infrastructure 
there is actually a disincentive for 
investing in measures that mitigate risk 
of disruption whether it be from 
naturally occurring or manmade events, 
because local and State officials can be 
almost certain that when these 
low-probability, high consequence 
events happen, the Federal Government 
will come in afterward with significant 
resources to make them whole.” 

Dr. Stephen Flynn, Professor and Co-Direc¬ 
tor of the George J. Kostas Research 
Institute for Homeland Security at 
Northeastern University 
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Development, the U.S. Department of Agriculture, DOE, and FEMA. EPA's Water 
Infrastructure and Resiliency Finance Center appears well-positioned to lead this effort and 
can also conduct the necessary outreach, share best practices, provide technical assistance, 
and serve as a clearinghouse for effective mechanisms. 

DHS, Science and Technology Directorate should reduce the risk of implementing innovative 
technology and funding mechanisms by developing cost-share pilot projects with water 
utilities to speed adoption of better and more cost-effective approaches to service delivery. 
Successful demonstrations should include an evaluation of whether the mechanism is 
applicable to other sectors. 

Federal critical infrastructure investment should be repositioned to catalyze economic 
development; encourage smart, sustainable, and resilient systems; and create job 
opportunities and inclusion at the local level that will build public awareness and support 
for infrastructure investment. To achieve this, the President, through the Office of 
Management and Budget (OMB) and in coordination with the NSC, should direct the heads 
of all Federal departments and agencies responsible for critical infrastructure investment, as 
identified in PPD-21, to: 


Identify and report annually to OMB, all current and planned department/agency 
investments in critical infrastructure for which they have oversight; 

Design innovative programs and approaches that create job opportunities and local 
community benefits using Federal infrastructure investments; and 

Establish multiyear goals and performance milestones for critical infrastructure 
investments and include them in department/agency strategic plans. 


Recommendation 4. Increase technical and financial resources and 
expertise available to the Water Sector. 


The Federal Government should work with larger and well-resourced utilities to help improve 
the technical and financial capabilities of smaller or less-resourced utilities by creating programs 
that link regional technical resources to local water utilities and leveraging the established 
programs, expertise, and capabilities of universities. The Federal Government should also assist 
national and regional water associations to expand their outreach efforts that increase utility 
access to valuable tools and models. These efforts should emphasize improving the 
cybersecurity capabilities of water utilities that have limited cyber capacity. 

Specific Actions 

Create a network of land grant universities to build localized technical capabilities, services, 
and expertise for water utilities that can be leveraged with private funding, and help train 
the next-generation workforce. The initial program should start with 10 geographically 
dispersed universities that meet certain criteria, such as access to State funding, existing 
subject matter expertise, applicability to selected research topics, and their location. 
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The Secretary of Homeland Security should direct funding to water associations to increase 
outreach efforts of financial tools and life-cycle assessment models that help utilities justify 
necessary infrastructure investments and support improved asset management practices. 

NSC and DHS should expand cyber resources, expertise, and workforce training for the 
Water Sector. This should include sharing best security practices and applications through 
outreach and leveraging existing programs such as the Protective Security Advisor's 
cybersecurity initiative. 


Recommendation 5: Strengthen Federal leadership, coordination, and 
support for Water Sector resilience. 


The President should strengthen Federal leadership on water infrastructure issues by 
coordinating across Federal agencies, raising awareness about the importance of water, 
leveraging investment to create job opportunities and inclusion for local communities, and 
identifying and removing legal, regulatory, and policy barriers that impede investment and 
implementation of resilient measures. 

Specific Actions 

Establish a temporary high-level Federal coordinating body led by DHS—with senior-level 
representatives from major agencies that have a role in water—to proactively lead 
collaboration across Federal, State, and local governments and the Water Sector, with 
particular emphasis on extreme and national-level events. To avoid creating another level of 
bureaucracy, the coordinating body should be limited to two years. 

The focus on water at the Federal level has 
traditionally been on clean water (EPA), control 
of water resource infrastructure (USACE), and 
emergency response (FEMA), with little 
emphasis on proactive resilience and security. 

One of the first tasks for the Federal 
coordinating body should be to identify barriers 
to resilience and rapid recovery in existing 
Federal oversight, laws, and regulations through 
analysis. 

The review should result in recommendations for statutory reforms that could promote 
resilient activities, encourage innovation, and provide flexibility in regulatory 
compliance during emergency situations. 

The review should also ensure that rules do not overlap or overrule each other. 

The Federal coordinating body, working with national water associations and the Water 
Sector SCC and GCC, should initiate a national public outreach campaign to increase 
awareness about the importance of water services. 


® • Right now, the way [environmental 
laws and regulations] are being applied, 
is like taking a 1965 Ford Mustang 
manual and trying to fix a Prius.” 

Patricia Mulroy, senior fellow in the 
Metropolitan Policy Program at Brookings 
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Within one year of issuance of this report, the NSC, in coordination with the Council of 
Economic Advisors, should convene a national public-private philanthropic leadership forum 
with representatives from business, government, community advocates, education, labor, 
and philanthropic organizations to determine the best approaches for leveraging Federal 
infrastructure investments to increase economic opportunities and build public support for 
Water Sector investment. 


C. NEXT STEPS 


Our message is clear: we can no longer ignore the deterioration of the Nation's water infrastructure 
in the face of emerging and uncertain risks. Water utilities have done a remarkable job of keeping 
the water flowing in the face of disasters and budget challenges. But growing interdependencies 
among lifeline sectors, and the vital role that water plays in nearly all human endeavor, demands 
more proactive steps. 

Building and sustaining a resilient water infrastructure must be a top national priority. It will require 
stronger Federal leadership, more funding, and collaboration, commitment, and perseverance 
among all Water Sector partners. Investment in infrastructures must also be tied to investment in 
our people, our communities, and our economy. Cities and communities across the country face 
chronic unemployment and under employment, inequality, and affordability challenges that require 
urgent national action. Special attention must be given to our most vulnerable populations in high 
needs communities. The weak levees in New Orleans and the corroding lead pipes in Flint drive 
home important lessons about the need for public/community engagement, greater accountability/ 
transparency, and expanded partnerships in building and operating critical infrastructures. 

Fault lines in the Nation's water infrastructure have been slow to emerge and virtually invisible to 
most of us. Reversing this trend will not be easy. The risks are complex and the challenges in 
investment, workforce development, and managing extreme threats will strain even the most 
capable utilities, and overwhelm smaller ones. We must not simply rebuild old and failing systems; 
we must build-in resilient characteristics by leveraging the capabilities of all partners. 

To succeed in this endeavor, we must generate strong public interest, support, and the political will 
to reinvigorate crumbling infrastructure. New investments in smart, sustainable, resilient 
infrastructure must be used as a catalyst for job creation, economic competitiveness, and an 
equitable and shared prosperity. New investments in communities will translate into greater 
support for the infrastructures that serve them. Simply put, when infrastructures serve people, 
people will support infrastructure. 

Strengthening the security and resilience of our critical infrastructure exceeds the capabilities of any 
one company, sector, or government agency. Water associations, NGOs, academia, and the private 
sector, particularly CEOs, must be engaged and committed to progress. Much of the responsibility 
rests with the owners and operators who design, build, operate, maintain, and repair the 
infrastructure, but Federal and State governments are critical partners in this endeavor. The 
government must make it easier for the owners and operators to invest in infrastructure 
improvements; they must identify and remove regulatory barriers that inhibit resilient behavior; 
they must help to identify and mitigate cross-sector risks that hide between the seams of 
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interdependent sectors and regions; they must develop measurable standards and best practices to 
guide water agencies in their resilience efforts; they must leverage the science and engineering 
resources of our national laboratories and universities to develop innovative technologies and bring 
them to market; and they must strengthen leadership and coordination among agencies across all 
levels of government. 

We believe this study, along with our previous ones, provides a practical template for action that 
can help ensure the long-term security and economic prosperity of our Nation's critical 
infrastructure. 
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APPENDIX B. 

COMPENDIUM OF INFORMATION FROM SUBJECT 
MATTER EXPERTS 


This appendix synthesizes information from Working Group interviews and Study Group panel 
discussions and interviews with Federal agency representatives and subject matter experts (SMEs) in 
water and wastewater systems and critical infrastructure. It is organized into six sections: 

• Water Sector Risks and Barriers to Resilience 

• Cross-Sector Dependencies and Interdependencies 

• Risk-Management Policies and Practices 

• Infrastructure Investments and Funding 

• Making the Business Case 

• Leadership and Coordination 

I. WATER SECTOR RISKS AND BARRIERS TO 
RESILIENCE 


In the Water Sector, resilience focuses on minimizing water and wastewater service outages and 
recovering services as soon as possible following a disruption. To do this, utilities need to have the 
capacity to maintain operations despite challenges to the system, such as stressors, incidents, or 
disruptions. However, there is no consistent definition of resilience used throughout the sector. 
Note that while the engagements with SMEs focused on resilience, the security of systems— 
reducing the risk to critical infrastructure by physical means or cyber defense measures—is 
embedded in many aspects of resilience. Some highlights on Water Sector resilience: 

Utilities tend to focus on response after a major incident (e.g., severe drought) and not on 
resilience before an incident occurs. 

Shifting to a next generation resilience strategy will change how utilities manage risks. 

• All-hazards preparedness perspective is key to resilience. 

Utilities need to plan for emerging threats. Such threats for the Water Sector include 
increasingly severe weather events, capacity issues stemming from changes in customer 
demographics and movement patterns (e.g., increased movement toward urban 
environments and coastlines), and cybersecurity. 

Utilities should examine infrastructure criticality, potential failure consequences, single 
points of failure that could cause significant problems, and ways to mitigate against each. 

Resilience is entirely voluntary for utilities, and must be balanced against other priorities, 
such as regulatory compliance, available funding, demographic shifts in customer base, and 
aging infrastructure. 
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There are five key barriers to resilience: 

Governance structure is not organized to advance resilience. It's organized around narrow 
political jurisdictions (e.g., local, county, State, Federal. However, infrastructure is 
increasingly regional, metro-regional, and interdependent. 

Limited training and education are focused on resilience. This makes it a challenging to have 
a workforce that can understand the complexities of resilience. 

Sectors have limited understanding of infrastructure systems, their vulnerabilities, 
interdependencies, and the hazards that will disrupt them. 

Infrastructure systems are generally not designed for resilience. They are designed for 
efficiency, safety, and security. This does not account for the fact that infrastructure will 
likely fail at some point and need to recover. 

There is a lack of economic incentives for sectors to invest in resilience, and sometimes 
there are disincentives for investing in resilience. This is particularly pronounced in the 
Water Sector. 

The U.S. Environmental Protection Agency (EPA) has identified four critical components or core 
elements of resilience: 

• Risk assessments to outline risks and what assets are at risk 

• Emergency response planning 

• Training and exercises 

• Recovery 

Within each of these, EPA set basic and advanced benchmarks, but they are optional to implement. 
Other components to resilience include: 

Having an emergency resource plan, including backup power and supplemental employees 
to operate facilities in an emergency. 

• Establishing multiday water storage capabilities 

• Finding mutual aid and assistance 

Revising the National Incident Management System (NIMS) to prioritize Water Sector 

• Examining what finances a facility has available for recovery 

Long-term threats to water infrastructure include infrequent/uncertain hazards and extreme 
weather events, limited funding and flexibility, and aging infrastructure. 

Hazards are well-established risks, but are infrequent and uncertain. This uncertainty 
generates inaction. 

Organizations need to establish what level of risk they are comfortable with and create 
response plans. While it may be impossible to prevent all impacts of an event, planning 
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shortens recovery time. Utilities have to build risks into planning, particularly with securing 
major equipment. 

Utilities and local governments are planning for resilience at a local level. However, threats 
such as extreme weather cross jurisdictional boundaries. The Water Sector needs to plan for 
infrequent hazards and justify expenditures that mitigate against these threats. 

Limited funding for infrastructure investments threatens resilience. The current price of 
water is not sustainable for full recovery of the cost of service. 

Aging infrastructure including the physical degradation of infrastructure is a major issue, 
particularly for wastewater utilities. Aging infrastructure can lead to public health problems. 

Black sky events are natural and manmade forces that are high-impact but have an uncertain 
probability. These could cause a power outage more extensive and more severe than those that 
occurred during Superstorm Sandy. 

• Black sky events have uncertain probability, but are not low-frequency. Risks are growing, 
especially in terms of manmade hazards. 

• Black sky events cause wide area power outages that may extend for months, with the twin 
effects of long duration of power loss and physical damage to Water Sector infrastructure. 

Manmade hazards, cyber, kinetic, and electromagnetic interference attacks pose a 
substantial threat to the electric and natural gas industries, with cascading effects on the 
Water Sector. 

The United States is overdue for a catastrophic earthquake in the New Madrid Seismic Zone 
on scale with the 1812 earthquake. This would cause a massive electric and natural gas 
infrastructure failure. 

Utilities have built some resilience for black sky events, but additional preparedness is needed. 

Utility chief executive officers (CEOs) will decide what constitutes prudent investments 
against black sky hazards. Focusing on black sky preparedness is important, but incremental 
preparedness for less intense events is also useful. Practical, step-by-step improvements 
could improve overall preparedness. Water executives could focus on incremental 
improvements for power outages. 

• Sector-Specific Agencies (SSAs) for the Energy and Water Sectors have a vested interest in 
advancing resilience and addressing dependencies in the event of large-scale power 
outages. The Resilience for Black Sky Days report (conducted on behalf of the National 
Association of Regulatory Utility Commissioners) contains catastrophic scenarios for 
regulated utilities. The report examines the cost associated with not preparing for these 
low-probability, high-consequence events. 

It is important to examine resilience data, understand where we are today, and identify 
preparedness gaps. 

There is a lack of cross-system visibility for how black sky factors could disrupt functions. 
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Power failure is the largest risk dependency to the Water Sector and can generate regional and 
national impacts. 


There is a lack understanding about how a long-term power outage would disrupt municipal 
functions. If electricity is down for an extended period of time, utilities would not process 
wastewater effectively, if at all, crippling the city and leading to evacuations. 

Advanced systems—such as wastewater treatment systems that are highly mechanized and 
reliant on energy—are more vulnerable to disruption. 

For large plants, available generators may not be large enough to address power 
requirements. 

Cybersecurity vulnerabilities of most concern include spearfishing; insider threat; the cyber¬ 
physical nexus; and impacts of an attack on operations, automated systems, supervisory control 
and data acquisition (SCADA) systems, and public confidence. 

Cybersecurity is not a one-dimensional problem; there are vulnerabilities in personnel, 
processes, and technologies. 

Control rooms can be vulnerable to spearfishing, inadvertent attacks, or undetected or 
unauthorized system access. 

Distributed systems make understanding cyber vulnerabilities difficult. The operator may 
not see the cyberattack (as they would a physical attack) because of distributed systems or 
because the attacker wants to remain undetected long enough to incur significant damage. 

IT security consequences, risks, and vulnerabilities are different on the operations side than 
in billing or program management systems. Security measures should be different 
depending on the environment. 

A cybersecurity failure in the Water Sector could have cascading effects across multiple 
sectors because of interdependencies. 

o For example, data centers depend on huge amounts of water to cool systems. If 
their water source is compromised, data centers cannot function without adequate 
alternative water sources. This would affect the operations of many interdependent 
sectors. 

The Water Sector's cybersecurity challenge is complex and cybersecurity capabilities vary 
depending on resource availability and utility size. 

A variety of stakeholders in the Water Sector are connected to cybersecurity—vendors, 
engineers, owners/operators—and risk can generate from anywhere in this chain. 
Exchanging information is critical. 

o Cybersecurity principles are often not embedded throughout an entire organization. 

o Vendors may not have the cybersecurity tools a utility needs. However, vendors can 
adapt their practices to industry norms. 
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o Comprehensive cybersecurity training and resources is necessary to ensure that 
personnel, across the sector, are up-to-date on cybersecurity solutions and 
practices. 

o There is an opportunity for adopting/adapting cybersecurity practices from the 
private sector. Expanding public-private sharing of information regarding cyber 
threats and incidents would be helpful. 

Utilities need more guidance on how to conduct cybersecurity risk assessments and 
prioritize assets. Although excellent guidance is available through associations, its 
application remains comparatively limited. 

Vendor cyber vulnerabilities, such as limited cybersecurity in products sold to water utilities, 
can create Water Sector cyber insecurity. 

SCADA systems are not standardized between facilities and do not have consistent 
interoperability with other water-automation programs. This leads to varying levels of 
cybersecurity risk. 

Smaller systems often lack resources and specialized personnel for large-scale cybersecurity 
improvements. Some large facilities have the resources to separate their Internet 
connectivity and infrastructure between operations. Smaller systems generally lack this 
capacity, resulting in more risk exposure. 

Maintaining and enhancing a viable workforce is a core challenge for the Water Sector. 

Experienced personnel are a crucial part of the safe and reliable operation of water utilities. 
As risk evolves and new risks emerge, new or improved skill sets are required, and 
sometimes training commensurate with these risk areas is costly. 

Retirements and attractive pay outside of the Water Sector can result in a loss of 
institutional knowledge. 

o About 30 percent of the Water Sector workforce is eligible for retirement. The 
sector is actively working to respond, including examining how it can compete with 
private sector employment. 

o Obtaining and retaining cyber expertise is a particular challenge. 

Training, development, and recruitment are opportunities where the Federal Government 
can help. Industry can partner with the Federal Government on retraining the industry. 

Water utilities must prepare for a variety of weather events and develop tools for comprehensive 
extreme weather planning. 

Severe storms, flooding, drought, changing weather patterns (e.g., El Nino, more frequent 
severe storms), and earthquakes are the natural events of most concern to utilities. Such 
events are difficult to plan for and can lead to loss of pumping capacity, limited access to 
critical resources (e.g., chemicals), and power outages. The following provides context for 
these extreme weather events. 
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o 2016 El Nino is resulting in sea levels 6 to 10 inches higher than normal. "King tides" 
are becoming more threatening to coastal combined systems. 

o Severe, prolonged drought is particularly challenging because it may not follow 
predictable weather patterns. 

o During severe heat and wind events, the risk for water disruptions increases. For 
instance, water supply goes down because of water used to fight fires. 

o Major natural disasters, such as blizzards or hurricanes, are a major concern 
because they also affect the workforce required to operate the systems. 

• Efforts to address extreme weather events include: 

o Working with regional partners to diversify the water supply to limit the effects of 
severe drought. 

o Studying extreme weather events and determining how they might impact 
infrastructure and what projects are needed (e.g., stormwater capture). 

o Understanding risks and vulnerabilities. Oftentimes, third-party organizations (e.g., 
nonprofit, private) can find vulnerabilities that were not anticipated by the owners 
and operators. 

o Investing in preparedness, such as ensuring equipment is available for long-term 
use. Systems with generators require adequate fuel to run the generators or backup 
power. 

Climate change will affect water infrastructure in different ways depending on the region's 
vulnerabilities. The combination of aging infrastructure, population growth, and potential 
storm surge magnifies the effects of sea level rise for East Coast utilities. Consequences may 
include flooded sewer lines and salt water intrusion. In the Western United States, utilities 
experience water scarcity issues. 

II. CROSS-SECTOR DEPENDENCIES AND 
INTERDEPENDENCIES 


There are critical interdependencies between the Water Sector and other lifeline sectors. These are 
often not fully understood until after an incident occurs. In addition, sectors may lack visibility into 
the vulnerabilities of other sectors. This may be compounded by a reluctance to share information 
on vulnerabilities, both inside sectors and among interdependent sectors. 

Dependencies and interdependencies exist along the Water Sector supply chain. The Water Sector 
has dependencies on sectors such as the Energy, Chemical, and Transportation. It has 
interdependencies with most sectors (e.g.. Healthcare and Public Health are dependent on water). 

Water and wastewater utilities rely heavily on access to chemicals, transportation networks, 
and energy supplies. 
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Personnel that know the system and that are trained in recovery processes are critical to 
resilience. Both within the Water Sector and along the supply chain, they are critical to 
maintaining operations. Personnel are needed to implement procedures. 

• Challenges for addressing dependencies include: 

o Cascading failure analysis helps to identify and evaluate dependencies. However, 
sectors do not commonly share vulnerabilities. 

o Water distribution and collection systems may be inadequately addressed during 
analysis since they are located outside the central utility. 

o Technological and regulatory barriers can prevent utilities from securing onsite 
energy supplies. 

o The Water Sector needs to coordinate with the Energy Sector to restore power after 
a long-term loss of power. Priority customers rely on both water and energy, so the 
sectors should coordinate restoration based on the criticality of customers. 

Action is needed to better understand cascading impacts (including regionally) and vulnerabilities 
throughout the sector. There is a need to break down silos and focus resources to address 
governance barriers. 

The vulnerabilities of larger supply chain systems, such as those outside of the Water Sector, 
are a major concern to local water utilities. There is a need for better dialogue on these 
vulnerabilities. 

o The Water Sector prides itself on silent service (i.e., reliable, consistent service). As a 
result, facilities may not fully understand or be reluctant to share their 
vulnerabilities. 

o Utilities are impeded by the limited sharing of vulnerabilities along the supply chain 
and are unable to conduct adequate cascading failure analysis and supply chain 
vulnerability identification. 

The Water Sector needs to examine Energy Sector dependencies. Water utilities could 
operate "off the grid" (e.g., use co-generation and onsite generation to ensure continuity of 
operations). 

o However, the utility will be treated as an energy generator and not as a water 
facility (and will become subject to energy regulations). This adds significant costs, 
which must be justified to customers and stakeholders. 

• The Federal Government can support coordination between dependent sectors. 

Although every water system has a unique set of assets/processes and operations are 
individualized, there is an increasing emphasis on creating system interconnections, where 
possible to allow greater flexibility. This enhances resilience, particularly for severe, long-term 
events such as droughts. 

System interconnectedness has driven utilities to consider a regional utility system. A hub 
would provide wholesale service to smaller utilities while all utilities are networked. 
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However, there is a concern that such a network would transmit cascading failures during 
disruptions. 

Organizations are focused on understanding dependencies among water systems and 
addressing cross-jurisdictional challenges. More attention is being directed to coordinated, 
long-term management of water resources. 

III. RISK-MANAGEMENT POLICIES AND PRACTICES 


The Water Sector maintains a key focus on effective all-hazards risk-management policies and 
practices. However, additional work is needed to ensure policies and practices are responsive to the 
risk environment and promote resilience. Adopting a comprehensive resilience framework that is 
forward thinking, focused on aging infrastructure and asset management, coordinated and inclusive 
of cybersecurity would advance resilience. In addition, those outside the Water Sector should 
recognize the sector as a lifeline sector during emergency response. 

Utilities are moving toward an all-hazards emergency management approach, implementing a 
variety of risk-management solutions to combat a range of risks. However, investments in 
improved Water Sector response and recovery are needed. 

Examples of preparedness include training, planning for incidences beyond what is 
traditionally expected, using new technology and tools (e.g., flood inundation maps), and 
conducting large-scale drills on Unified Command. 

Depending on the utility size, infrastructure, and provided service, utilities may have 
difficulty in locating resources to facilitate a rapid recovery. 

o Many communities will be asking for the same equipment and supplies at once. 

o Navigating "red tape" and the logistics of getting equipment are challenges. 
Guidance, planning, and region-specific depots would provide much needed 
assistance. 

o Investing in backup energy equipment is costly, and it is difficult to provide an 
effective return on investment. Getting the ratepayer to understand investment 
needs is challenging, as ratepayers may have never experienced a utility losing all 
sources of power at once. 

o Replenishment of fuel stocks is a problem, especially during major events. If there 
was a widespread incident, fuel would be hard to get everywhere. 

o Backup needs could be registered with the 249 th Engineering Battalion (Army) with 
dimensions, sizing, and fitting measurements to help utilities obtain replacements 
quickly. 

o Utilities could connect with other utilities that have similar equipment. 

The Water Sector would benefit from its own Emergency Support Function (ESF). Emergency 
management agencies train and include other government agencies, but they do not 
perform enough outreach to utilities. Incorporating the private sector is critical to response 
efforts. 
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o The Emergency Management Assistance Compact (EMAC) structure can be 
leveraged to secure water-specific resources. This mutual aid structure can be 
tested through a coordinated exercise. 

The Water Sector should improve partnership and information-sharing capacity internally, 
and with other sectors and government agencies. It can do so by: 

o Developing utility partnerships to work through emergency planning challenges, 
providing training from more experienced utilities, and regularly conducting cross- 
jurisdictional exercises. 

o Participating in information-sharing networks (e.g., Water/Wastewater Agency 
Response Network (WARN), Information Sharing and Analysis Center (ISAC)) to 
ensure that a broader population is aware of threats and resources. These networks 
aggregate information from many sources. 

o Strengthening partnerships with local/State emergency management and law 
enforcement agencies. Emergency managers can train utilities in emergency 
management. Exercises and discussion forums will provide an opportunity to 
uncover gaps and understand roles/responsibilities. 

Many utilities have an emergency response plan for the organization, but not a response 
plan for a large-scale, regional incident. Hosting exercises—whether regional or all¬ 
hazards—ensures that organizations understand their responsibilities and provides an 
opportunity to test emergency response plans. 

Improving risk-management solutions and considering effective response/recovery solutions 
enable utilities to navigate major disasters and prolonged disruptions and to mitigate cascading 
consequences. 

• Many communities will be asking for the same equipment and supplies at once. 

Business continuity planning is critical; it may be necessary to release water at a lower 
quality rather than to have sewage leaks. Flexibility for quick solutions is needed. 

There needs to be better scenario planning rather than just growth-based planning. 

Response personnel should understand the Water Sector has unique characteristics, such as 
cascading effects on schools and hospitals. A Water Sector event can quickly escalate into a 
major event and potentially into a political one. 

• At Battery Park City during Hurricane Sandy, various buildings needed onsite treatment. The 
area's distributed infrastructure (e.g., water treatment, systems) included 80 natural water 
facilities affected by the event. Facilities were up and running 24 hours after Sandy because 
they were not in flood-prone areas and energy back-up was obtained within a day. This 
enabled utilities to maintain services throughout the disaster. 
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The Water Sector needs to adopt an inclusive resilience framework that is forward thinking and 
that enables faster recovery after major disasters. After each disaster, rebuilding infrastructure up 
to higher standards means utilities will come back online quicker. 

The U.S. Water Alliance is focused on "one-water framework" for water resource 
management (e.g., drinking water, storm water, and wastewater) as a way to improve 
community outcomes. 

Based on past extreme weather events, some utilities have developed more robust 
resilience plans, such as detailed plans that addresses severe and long-term drought 
patterns. 

Workforce management and access is an issue that needs to be addressed. Skilled 
workers—already in short supply—must be able to reach facilities and have adequate 
resources to operate safely for extended periods. 

The sector needs a common set of performance metrics for resilience and green 
infrastructure. 

A comprehensive regional risk-management plan that should incorporate all sectors in the 
region. 

Revising the EPA Needs Survey for wastewater and water utilities should be examined. 
Surveys are based on specific statutory criteria. The Needs Survey should capture evolving 
needs related to preparedness and resilience. 

Due to aging water infrastructure, utilities should implement an asset management programs. 

Asset management enables utilities to be efficient and better anticipate when equipment 
replacement will be needed. Effective asset management programs can provide more 
reliable and resilience service with comparatively small investment. 

Utilities should include these measures as part of an asset management program: 

o Inventory, track, and assess key system components with respect to age, 
application, and condition. 

o Ensure they have two sources of water supply to maintain drinking water 
availability, water pressure, and fire capability. 

o Examine storm water capture systems and how to use alternative sources of water. 

o Identify key accounts for prioritized restoration, depending on water service 
criticality. 

o Consider prioritizing service to areas that were already stressed before the 
shock/incident (especially for disadvantaged populations). 

Utilities are making investments in storm water management—being able to use water 
within their systems and not just pumping water out. Water can be stored and used for 
emergencies. 
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Cybersecurity practices at utilities have increased to focus on planning, understanding the 
physical-cyber nexus, coordinating across the supply chain, balancing budget priorities, and 
integrating components. 

Cybersecurity requires well-thought out plans, but not all utilities have included cyber in 
their risk-management plans. 

Utilities must understand both cyber and physical risks. Combining cyber and physical 
security processes and assets could simplify security infrastructure management, making it 
easier to detect and prevent security incidents and improving response and recovery efforts. 

Designers, vendors, and owners/operators must collaborate to find solutions for the sector. 
Vendors should understand new devices (including new technologies) and the requirements 
for integration into new systems. However, it can be costly to pay for multiple vendors to be 
onsite and remain updated. 

While utilities are used to investing in physical infrastructure with long life cycles, the life 
cycle of IT is short, and often misunderstood by utility management. For example, risk 
assessments are used to prioritize investments, which requires policy decisions related to 
specific aspects of SCADA and cyber system engineering. Decision-makers may not have the 
necessary expertise or understand the difference between IT and physical security. 

Sometimes heterogeneity and noncentralization of technology is an asset. In an attack, the 
operator may not have access to the entire system because the utility is segmented. 

EPA and the American Water Works Association (AWWA) have issued beneficial 
cybersecurity guidance to help improve water utility cybersecurity practices. 

Although cybersecurity practices have improved, additional investment in cybersecurity is 
necessary. 

Investing in cybersecurity information sharing is critical to preventing, responding to, and 
recovering from a cybersecurity incident. 

o The WaterlSAC is used to collect threat information, conduct analysis, and share 
information with partners. However, some information requires further research 
and vetting by the utility. 

A cybersecurity mutual aid network (e.g., WARN network) or knowledge sharing would help 
address cybersecurity challenges. 

o There is no functional equivalent for cyberattack mutual aid in the Water Sector. 
Personnel specially trained for cybersecurity, but deployable to partner utilities, 
may be worth developing. 

The sector needs leadership, unified security protocols, and common cybersecurity 
specification requirements for products/processes used in the Water Sector. 

o Leadership buy-in would empower cybersecurity programs. The Water Sector has a 
top-down security culture and cybersecurity programs should take this into account. 
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Building cyber resilience into all aspects of water utility business and improving security 
measures (e.g., vendor-managed security processes) along the supply chain would help to 
address cybersecurity challenges. 

Water is often not recognized as a lifeline sector during emergency response. Water infrastructure 
and the critical nature of its services should be a priority both before and after an incident. 

The Water Sector was successful in sustaining service during the Sandy outage, but many 
utilities were on the brink of failure due to lack of backup power, limited fuel for generators, 
or generators burning out from running too long. 

o Water was not given priority when fuel for generators or equipment was delivered. 

o Employees were unable to access facilities to help restore services, and in some 
cases had to find ways around police barricades. 

Although some Emergency Operation Centers (EOCs) have increased representation from 
the Water Sector during emergencies, this needs to be applied more consistently to ensure 
water is incorporated into response efforts. 

The Water Sector needs to identify and set realistic goals for a long-duration power outage 
to maintain services and to reduce the need for mass evacuations. Playbooks need to be 
created to achieve those goals, and targeted investments are needed to carry out the 
playbooks. The playbooks should outline what the utilities can do to help themselves and 
what partners can do to maintain service. 

o Water utilities can use advanced planning to provide service continuity for the 
highest priorities in their communities (e.g., lowering water pressures, limiting the 
service area). 

o Water Sector partners can prioritize distributing diesel fuel to water utility backup 
generators, providing extra parts, and resupplying chemicals during an extended 
power outages. 

o Military agencies (including the U.S. Army Corps of Engineers (USACE) and the 
Defense Logistics Agency) are integral to these efforts. 

IV. INFRASTRUCTURE INVESTMENTS AND 
FUNDING 


Infrastructure investment and funding levels may not be sufficient to address the Water Sector's 
resilience needs. Water systems planning should consider future system needs, and investment 
decisions should consider risk assessment results. Next generation resilience financing is driven by 
funding availability, affordable and responsible rate structures, and informed decision-making. 
However, resilience investment challenges exist and must be addressed in order to achieve next 
generation Water Sector resilience. 
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Water systems should be planned to ensure performance of systems against current and emerging 
threats. This entails building a robust set of planning and decision-making tools to help resilience. 

Water utilities will see increased costs in regions with high population increases. However, 
per capita water use is decreasing and revenues are flat. Infrastructure investments mean 
significant rate increases, because sales are flat. This issue only gets worse as infrastructure 
ages. 

Utilities are unsure what level of response to prepare for and how much to invest for each 
risk. Utilities focus on allocating resources to assets directly impacted by an event but not on 
preparing the whole system for future events. 

o There are limited resources (e.g., time, information, funding) devoted to resilience- 
most of the focus is simply on responding to the disruption and not on mitigating or 
preventing it. 

Capital improvements can be used to address aging infrastructure and to mitigate 
vulnerabilities. 

Utilities should leverage Federal resources, capabilities (e.g., the U.S. Department of 
Homeland Security (DHS), U.S. Department of Energy (DOE)), exercises, and resilience 
assessments against the utility's highest infrastructure priorities. 

Effective planning models from outside the sector can be leveraged for infrastructure 
investment. 

o The private bond market has model for natural disaster and risk assessment. 

o If you look at the insurance industry, two weeks of disruption is a key number. If 
you're out more than two weeks, small businesses have difficulty returning to 
normal operations. Defining this temporal endpoint would be helpful. There is also a 
distinction between manmade (terrorist) and natural hazard events, in terms of 
investment. 

Investment decisions should be based on risk assessment results. A stronger link between asset 
management planning and day-to-day operations is needed. 

A risk assessment-informed investment approach would take the unique hazards of every 
region's water preparedness needs (e.g., flood, hurricane, earthquakes) into account. 

• More perspectives are needed for future investment decisions 

o Managers should collect information from utility workers, 
o The customer should be at the center of the business model. 

• Priority should be given to infrastructure projects that incorporate resilience. 

• Utility managers should plan for population growth. 
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Improving information sharing would provide a better understanding of the risk environment for 
utilities, government agencies, and the public. 

There is a need for more information sharing from the Federal Government to quantify the 
probability of certain risks, including potential terrorist attacks. 

One barrier to information sharing and assessments is that utilities consider risk information 
to be proprietary. 

Partnerships sponsored by the Federal Government would enable utilities to share 
resources for mitigation and resilience. 

The information-sharing environment remains challenged by limited information and that 
utilities may not fully understand how to act on that information. 

o The industry does not self-report, so they don't have aggregated data to share. 
There is a lack of reporting outside of regulatory requirements. 

o Consequence analysis information is limited. 

o More data on trends related to evolving threats (e.g., cybersecurity) are needed. 

Factors that drive next generation resilience financing include financing portfolio variability, 
affordable and responsible rate structures, and informed decision-making. 

The portfolio for financing options differs depending on the community—e.g., metropolitan 
communities have more options available than small communities. Options also access 
depend on staff expertise and utility risk tolerance. 

o For large, credit-worthy, prosperous communities options include: cash funding of 
capital, public issuance of bonded debt (fixed vs. variable rate). Other funding 
source include State Revolving Fund loans and private capital (less common in the 
United States than the rest of world). 

o Smaller systems have less financial flexibility, which can put them at risk since they 
are less able to make adjustments to respond to emerging risks. They often focus on 
resolving day-to-day issues. 

o Utility needs, assets, and communities served vary across the sector. Utilities can 
select the "right" financing mechanism based on their environment. 

o Associations (e.g., National Association of Clean Water Agencies (NACWA)) have 
taken a key role in socializing public-private or private-exclusive funding options. 

Pricing and funding levels are largely variable throughout the sector. Examining how to raise 
rates in an affordable and responsible way and improving the cost-of-service dialogue are 
needed to improve resilience investments. This includes: 

o Securing community buy-in for investments is crucial and difficult. 

o Political pressure keeps rates and charges to customers low, and impedes the case 
for resilience investment. 
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o Alternatives should be examined for how costs should be allocated. Some resilience 
costs can be allocated based on a normal water utility model, but some of the costs 
can be allocated in a new way (e.g., based on taxable property value). 

o In the future, utilities may move from a variable to a fixed model. The revenue 
streams will be more stable, but the variable model will put pressure on low water 
users (which are also low income users). 

o Utilities can price service for minimum health and sanitation needs and then use 
nonrate revenues to provide support for nonessential needs. 

Sharing best practices and success stories across the Water Sector would improve 
knowledge regarding resilience infrastructure investments. 

o In San Francisco, there was a $4.8 billion investment in seismic reliability. There was 
limited pushback because people understood the need for investing in this 
reliability. 

o The Smart Grid energy project is an example of successfully investing in resilience 
and raising rates. 

o Flint, Michigan, is an example of what not to do—the decision to switch water 
sources was an economic decision that was not cost-effective because it did not 
account for risks and potential disruptive events. 

Resilience investment challenges include addressing increased rate and resilience investment 
justification challenges, institutional barriers, and available insurance solutions. 

Some utilities may divert significant portions of water-service feeds to other purposes (e.g., 
use as general funds.) 

Servicing low-income or disadvantaged communities is a challenge. Utilities need to move 
forward without further disadvantaging people. 

o More robust affordability models and support programs are critical. 

o Utilities are not willing to raise the rates to make capital improvements. 

Rates and charges to customers need to keep pace with investment, especially absent of any 
significant Federal and State government investment in local infrastructure. 

o Justifying resilience investments is difficult because customers do not see anything 
new—it is insurance for a future event. The utility is not getting new customers or 
providing a higher level of immediate service. Utilities may not think the investment 
is worthwhile. 

o If you make investments and reflect that cost in the rates, the cost of service 
becomes a challenge. 

o Utilities that successfully implemented rate increases under the full-cost pricing 
model phased rate increases over several years and conducted significant public 
outreach to explain the increase, what the money was needed for, and the plans for 
making the investment in the systems. 
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The Water Sector has many financing options. The private sector has flexibility and interest 
in investment but there is no open dialogue to discuss options. 

Regulatory restrictions and targets may limit smart investments. Many utilities who invested 
in supply reliability are still being held to water supply reductions/conservation cuts—the 
sector is painted with a broad brush. 

o By using rigid pricing models, States may hinder the ability of utilities to invest in 
resilience. 

More work needs to be done to examine how best to allocate large infrastructure 
investment expenses efficiently. Long-term capital planning could be incorporated into 
budget processes. 

Utilities are interested in resilience-oriented insurance but innovative insurance solutions 
are limited. 

o The current way of thinking is an obstacle—State/local governments know they 
have the safety net of the Federal Emergency Management Agency (FEMA). Utilities 
need to move from being reactive to proactively building resilience. 

o Catastrophe bonds are worth exploring, as they make response and recovery 
resources available immediately. They also provide certainty that funds will arrive, 
allowing the bond holder to set up contracts/assistance ahead of time to speed 
recovery. 

Existing funding levels and mechanisms do not sufficiently address Water Sector resilience. 

There is a large deficit between the projected funding need for water infrastructure repairs, 
and the funding that is expected to be available. 

o The Federal Government used to be the main supplementary source of funding to 
local water authorities but recently State governments have taken on more of the 
burden. Tax and rate increases are often the result of this change. These revenue 
streams can be negatively perceived by the public if they are not properly framed. 

The State Revolving Funds (SRF) do not include resilience investments. Adaptation will cost 
billions of dollars, and there is not current path forward to pay for it. While some of it will be 
funded by rate payers, this is not sustainable over time. 

o Aging infrastructure intensifies investment needs, resulting in a larger funding gap 
than if resilience investments were instituted earlier. 

o More public outreach should communicate the need for resilient infrastructure. 

o More money is spent on mitigation than on adaptation. The Federal Government 
can support the shift away from event-driven financing. 

• Resilience funding is a challenge, due to uncertainty in calculations and lack of 

understanding. For instance, many utilities do not know how to operationalize climate 
change analysis data to make the necessary investments. 
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Existing mechanisms (e.g., FEMA Hazard Mitigation Funds) are not viable options to fund the 
necessary capital projects related to resilience. 




o Competing interests on who gets money and priorities are challenges. 

o Incentives to look at resilience and implement backup systems could be valuable. 

o Examine Federal highway funds allocation related to drinking/driving. This could be 
an example of matching investments to ensure appropriate resilience is considered. 

o The Federal Government can work to implement community behavior incentives, 
promote community engagement, and address resilience governance issues. 

Additional Federal funding and mechanisms, and innovative funding solutions are needed for 
infrastructure investment. 

The Federal Government can create a pool of money for utilities to tap into for resilience 
investments. 

The Federal Government can leverage the Low Income Home Energy Assistance Program 
(LIHEAP) model for the Water Sector. This would enable infrastructure investments to move 
forward without further disadvantaging customers. 

SRFs are particularly helpful for smaller issuers that have difficulty with market access. 
However, the funding comes with many Federal requirements, which can make the program 
difficult or costly to use. 

The Federal Government should update Federal funding conditions to require risk 
mitigation, recovery, and adaptation. Whenever there are incentives, the Federal 
Government should examine how to leverage that to get desired behaviors. 

The Federal Government should create a tiered structure for the Stafford Act to address the 
issue of relying on Federal after-the-fact aid instead of investing in resilience. 

o Tier I: Keeps current level of funding, but is conditioned on certain criteria. 

o Tier II: Reduced funding, if criteria is not met. 

• Create incentives for States to take action on infrastructure resilience. 

FEMA issued an Advance Notice of Proposed Rulemaking to receive comments on the 
agency establishing a Disaster Declaration for its Public Assistance Program. If communities 
take certain actions focused on mitigation and resilience, those efforts would be credited 
toward their deductible. If they do not take certain steps, in the event of a disaster there 
would be a certain amount of covered assistance that they would be responsible for paying. 

In addition to improved Federal funding mechanisms, public-private partnerships can 
encourage creative arrangements that benefit both the public and private sector and are a 
way to leverage existing resources. 
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Mitigation and recovery are key components to resilience. FEMA Mitigation Programs and the 
Public Assistance Program under the Stafford Act can help resilience investments. 

Pre-Disaster Mitigation Grant Program: The grant program assists communities with small- 
scale pre-disaster mitigation projects. 

The Hazard Mitigation Grant Program (HMGP) funds projects to reduce or eliminate long¬ 
term risks, consistent with State or local mitigation plans, following a Presidential major 
disaster declaration. 

• Public Assistance Program allows for repair and replacement of damaged public 

infrastructure (e.g., if a wastewater treatment facility or pumping station was damaged). 
During rebuilding, if those facilities decide to implement cost-effective mitigation measures, 
they could be covered up to 75 percent. 

V. MAKING THE BUSINESS CASE 


Resilience practices take time and capital investments to institute. Utilities need dedicated funding 
based on justification resilience investments. This requires that the customers and political decision¬ 
makers are is aware of the value of water, resilience, and the financial and planning tools necessary 
to forecast and plan for myriad hazards. 

The Water Sector may need to consider a new business model to encourage next generation 
resilience. 

Water infrastructure is invisible to customers. As a result, water functions are taken for 
granted until systems fail. The public is also not aware of what is required to maintain 
infrastructure, making it more difficult to explain the value of additional funding. 

Utilities need consistent messaging at the State and local level to ensure customers are 
aware of the value of water. Extensive community outreach and public education are 
needed to increase awareness and educate customers about their role in demand 
management and conservation. 

The relatively low cost of water in the United States makes it difficult to secure the 
necessary funding for large-scale water infrastructure projects. There is a disconnect 
between current rates and the true cost of maintaining water service. Structuring the value 
of these projects to nonmarket benefits makes the argument stronger. 

Private sector funding can be a potential solution. For example, in Corpus Christi a company 
determined that the local water supply was not resilient enough, so they are building their 
own desalination plant. 

Special consideration for low-income communities is needed. They are often affected first 
and the most by extreme weather. Legislation can direct requirements for resources to low- 
income communities. 

The sector must adopt resilient-design principles and convince decision-makers to fund 
future investments that lead to resilience. 
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o The old systems approach, based on historical data, is the cost of protection versus 
the cost of failure. This should change. 

o If we do not value or are not willing to pay for flexibility in capital investments, then 
it will be hard to know the required design criteria for facilities. 

o The sector should examine flexible infrastructure solutions (i.e., infrastructure that 
serves more than one purpose) and avoid generalizing risk—an individual utility- 
level approach is needed, structured around a sector resilience framework. 

Create a market around resilience, build tools, and emphasize a cross-sector approach 

Regardless of the business model (e.g., public versus private, single municipal owner versus 
multiple), utilities need customer support for rates, flexibility to respond, and fast and 
nimble solutions to disruptions. Examples include Lower Manhattan discussing the value 
proposition of major investments and the loss to commerce relative to hardening 
infrastructure and the U.S. Global Change Program. 

The Water Sector should build on green infrastructure practices to add resilience. It takes 
time for the government and customers to change their perceptions, and include security 
and resilience in infrastructure are new practices. 

o Green infrastructure is a relatively new concept to utility customers. The community 
needs to understand the value of sustainability, beyond additional costs. Additional 
grey infrastructure is more expensive. 

o Examples of green infrastructure investment include managing stormwater at the 
source, using solar panels, or implementing a green jobs program to help 
economically stressed areas. 

o The Green Infrastructure Calculating Tool shows how many gallons green 

infrastructure can capture and conveys it in an easily understandable way. Spatial 
information/data is always effective (e.g., showing things on a map is helpful). 

o Major cities are adopting green infrastructure. The NYC Green Infrastructure Plan is 
a tool used to manage storm water. In San Francisco, a regional nonprofit planning 
group (as a neutral broker) convened stakeholders and city departments to talk 
about green infrastructure being a collective opportunity for the city. 

o The U.S. Water Alliance is making the economic value argument about green 

infrastructure. The sector needs to talk about the benefits of integrated storm water 
management and to build collective ownership. 

Tools, modeling, and research enable risk-based, financial, and planning decisions. 

• Risk investments need to be well-informed to justify costs. 

o Utilities recognize they have to make smarter decisions and not just spend money 
on today's needs. Zero risk is unachievable and getting close to it is expensive. 

o Critical infrastructure interdependency tools (e.g., short-term, event-based 
modeling or examining water demands) are needed to enable decision-making. 
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o A consistent, locally and sector informed definition of risk is needed, along with 
standards and guidelines. 

o Models to estimate economic impact may be a good Federal investment. 

o The Federal Government can provide risk assessment and consequence expertise. 

o Modeling tools in the insurance industry could be leveraged for use in the Water 
Sector. 

o Science and engineering needs to be incorporated into water resilience planning 
and infrastructure improvements. One way to accomplish this is to integrate 
resilience into standards. 

o The Water Sector needs to have a more holistic approach for designs systems to 
better withstand challenges, recover, and adapt. Part of this is investing in 
sustainability. 

o Metropolitan-regional mapping should be conducted to understand infrastructure 
system dependencies that can also aid faster recovery in the event of failures. 

The frequency and intensity of extreme weather events require a new way of thinking. More 
"outside the box" scenario planning is needed. As the risk landscape changes, utilities have 
to plan for unusual/unpredictable events (e.g., a major cyber incident). 

o Extreme weather planning needs supportive funding structures, as current rate 
structures only cover regular operations and basic projects. Utilities have to justify 
investments. 

o Utilities have to balance risk acceptance. After an unusual event, utilities may be 
asked to install resilient solutions (e.g., generators) that can be costly and come with 
no guarantee that they will be used in the future. 

o Tools are good for short-term modeling, but are not as accurate in the long term, 
which is different from real-time feedback provided in the power industry. 

o There are effective models that forecast the direction, timing, and strength of 
storms. The National Hurricane Center forecast capability has improved noticeably 
over the last 20 to 25 years. They depend on satellite data, and aging satellite 
infrastructure is a concern. 

o The Water Sector must enable short-term and long-term planning. Short term 
planning includes how quickly snow melts and how to manage it. Long-term 
planning includes examining climate variables relating to runoff, which is more 
problematic. 

o In the long term, there is a need for good forecast capability (for supply of water) 
and scenario-based forecasting. 

o While there is scientific evidence regarding high-impact events (e.g., earthquakes, 
floods, and other natural disasters), an underlying impediment to implementing 
long-term solutions is local community opposition to permanent infrastructure built 
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in their area. We need decision-makers to present science in the clearest way 
possible. 

o Federal agencies, including EPA and USACE, have internal models and publicly 
available tools and models that can conduct forecasting both in the short term and 
long term. Modeling evaluates hydrology, the effects of demographic shifts, and 
cascading impacts on infrastructure to assist in accurately capturing future scenarios 
to aid in planning and preparation. 

o Disaster resilience uses different time scales. Some hazards (e.g., climate change, 
mega droughts) unfold over longer time frames and it is difficult to predict 
outcomes in order to fully justify investments. 

o Improved modeling and new technologies that combine sensor and historical data 
will enhance utility preparedness. 

o Government agencies often work together to ensure their climate change modeling 
and information is consistent. USACE works with other Federal agencies, such as the 
National Oceanic and Atmospheric Association (NOAA), and universities, to ensure 
that assumptions and modeling is consistent when they apply it to tools and 
resources. One example of this is their sea level change calculator, which is available 
to the public, and focused on USACE projects. 

o Modeling software and Water Sector-specific training support is needed. 

• Financial/Decision-making tools: 

o Resilient infrastructure requires major costs, which can impede resilience. One way 
to address this is to consider the current financial environment and calculate costs 
over planning windows that make sense to decision-makers. 

o Many hazards occur infrequently, but could cripple regions. Because of this, you 
have to convince people must be convinced the hazard is important. Hazard analysts 
need to make results comparable to the traditional planning windows used to make 
financial decisions. 

o The Water Sector should support research and technological development by 

disseminating success stories and best practices and collaborating with the research 
community (e.g., how to annualize costs for water infrastructure). 

More informed resilience activities, such as scenario planning tools, response exercises, 
employee training on automated technological solutions, and tools that account for the 
"human side of resilience," need to be deployed throughout the Water Sector. 

o Dealing with complex systems requires experience. Models do not always include 
the complexity/characteristics to capture the true nature of a system. 

o During major disasters (e.g., an earthquake or pandemic), the effects of the event 
on the workforce will be a major challenge to overcome. 

o About 25 to 30 percent of the workforce is approaching retirement. Utilities are 
conducting market-based benefits analysis on how to compete with the private 
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sector. This will allow the utilities to competitively re-staff 50 percent of the 
workforce in the next five years. The industry is also evolving into more specialized 
work and needs knowledgeable staff. 

• Research needs to: 

o Focus on energy efficiency and smaller-scale effective treatment operations. 

o Fund technologies that will limit future damage. 

o Encourage cross-discipline collaboration for better models. 

o Address snow-pack melting; cities are dependent on water imported from miles 
away. 

o Address seawater intrusion on local water supplies. 

o Examine the transportation-water connection. 

Utilities often struggle with making the business case for cybersecurity investments. 

o As cyber threats increase in frequency and intensity, customers will want to know 
what cybersecurity measures or programs have been implemented. However, the 
regular rate-paying customer is oblivious to potential disruptions from 
cybersecurity, as a consequence of the Water Sector's success in providing "invisible 
service." 

o Management may think cybersecurity solutions are too expensive. 

o Sector-specific cybersecurity tools that are sensitive to implementation cost issues 
are needed. 

The Federal Government can support resilience in the Water Sector by focusing on affordability 
and providing funding, conducting risk analysis, sharing best practices, and helping utilities "make 
the case" for resilience. 

The Federal Government can provide support through analytic work and risk analysis. 
Utilities do not have the capacity to downscale global climate models; national labs can help 
provide the tools to guide utility decision-making. 

Utilities had to implement security upgrades after the September 11 th attacks, and the 
public understood the need for this. If the Federal Government mandates a greater level of 
resilience and includes a resilience model for what infrastructure should look like, then 
utilities and the public will be better able to understand the need for changes and the costs 
associated with them. 

The Federal Government can support a group of professional associations or research 
foundations to examine these tools. National Institute of Standards and Technologies (NIST) 
committees can also help facilitate this kind of tool. 
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The Federal Government can help promote resilience solutions as best practices: 

o The Center for Neighborhood Technology works with local finance organizations to 
address water incidents by convening communities and financing infrastructure 
adaptation. 

o Los Angeles and Philadelphia embrace decentralized activities and collaboration. 

o Texas has diversified its water supplies to mitigate a system shut down because they 
were dependent on one supply. 

o San Francisco leverages its technology boom to secure resilient solutions and 
private sector investments. 

EPA's Water Security Division conducts outreach and provides technical assistance to water 
utilities. The division provides electronic software tools, including an in-process tool called 
the “Route to Resilience" to help facilities develop risk assessments by answering a series of 
questions (similar to online tax software). The division facilitates connections with 
water/wastewater facilities across the United States and conducts tabletop exercises and 
risk assessments. The training also helps foster relationships between agencies in the 
Federal Government. The division provides direct technical assistance, including helping 
with risk assessments. 

EPA's State Revolving Funds are a potential vector for funding to help communities achieve 
resilience. 

Following Hurricane Katrina, the USACE was part of a large-scale hydraulic modeling effort 
with the U.S. Department of Defense (DOD), universities, NOAA, and representatives from 
across the Nation and globe. The effort involved modeling physical features of the area, 
developing thousands of potential scenarios for the next probable maximum flood, and 
developing design criteria for New Orleans and Southeast Louisiana. 

o Following Superstorm Sandy, the effort was expanded and real-time flood 
inundation information is available to States to assist in decision-making. Other 
tools include coastal modeling and sea level rise calculators that can be applied in 
community planning and development decisions. 

The North Atlantic Coast Comprehensive Study's tools are publicly available and are being 
used to help communities across the Nation define their risks. 

WaterSMART (Sustain and Manage American Resources for Tomorrow) is a Bureau of 
Reclamation program that looks at the Nation's changing landscape and assists in 
determining whether modifications are needed to maintain a sustainable water supply. 
Factors such as climate change and population shifts yield recommendations such as 
conservation and water source shifts. 

o The Bureau also examines the risk of long-term dam failure. As the condition of the 
dam itself changes, the risk assessment is continually reviewed to identify necessary 
repairs. 
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The Regional Resiliency Assessment Program (RRAP) is a cooperative assessment of specific 
critical infrastructure within a designated geographic area and a regional analysis of the 
surrounding infrastructure. To improve the efforts in the RRAP, metro area dependencies 
should be examined and an implementation plan should be proposed. 

VI. LEADERSHIP AND COORDINATION 


There is a need for resilience at the regional level and for resilience across all sectors—not just the 
Water Sector—due to dependencies. Planning for and responding to all types of catastrophic events 
requires developing partnerships and acting regionally; major disasters should be seen from a 
regional perspective, not from local needs or the service area. However, a shift to a regional 
approach requires a new paradigm for how the systems are operated (i.e., not just on individual 
utility assets, but on operating systems based on regional needs). Coordination is needed between 
governments and utilities in the region, and should include hosting joint exercises and preparedness 
meetings. 

Collaboration between levels of government and the Water Sector has focused efforts and 
resources on defining a collective vision for resilience and identifying roles and responsibilities. 
Proven results have included creating local resilience strategies and ensuring water systems 
perform during situations more severe than planned. 

The greatest resilience progress is realized when jurisdictions/regions have mechanisms for 
collaboration. They convene multiple actors and take a regional approach. 

o In New York City, the "Big U" plan started out with fortifying lower Manhattan from 
storm surge. It evolved into a green infrastructure project, called Dry Line, designed 
to build resilient infrastructure that can generate private sector funding/investment. 

o In one State, when a small facility is unable to meet water quality standards, Health 
and Human Services is brought in to give guidance to drinking water constituents. In 
some cases, the utility is forced to merge with a larger utility in order to help finance 
projects. 

o Southern Nevada collectively defined the disaster response vision for the region. 

o Other examples include California and West Coast (seismic activity), South Carolina 
(floods), Contra Costa Regional Capacity Study (water transfer), Bay Area Regional 
Reliability (BaRR) project, and Lake Oswego (joint funding and planning water supply 
for the region). 

o Concepts of enterprise zones have been set up in the past and some are now 
considering resilience zones. 

o Mississippi River: planning, construction, and collaboration built into the system 
meant that the river performed successfully for situations that were much more 
severe than planned. 

Political will is required to collaborate with other regions, especially on the benefits to the 
State and region of resilience investments. 
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o Los Angeles Mayor Garcetti issued a water order to organize the region around "one 
water." 

o New York City Mayor Bloomberg included a "One NYC" resilience chapter in "Plan 
NYC" to help manage dependencies, especially based on lessons learned from 
Superstorm Sandy. 

Managing dependencies and interdependencies between sectors must be a priority for 
sectors, government agencies, and regional organizations. There is major interest in 
strengthening the connection between water, energy, and climate issues. Coordination 
exists but needs to be improved. 

o Inefficiencies are created by not looking at lifeline sectors (Transportation, Energy, 
Communications, and Water Sectors) as interdependent systems. 

o In California, State, regional, local partners examined Water Sector supply chain 
dependencies and interdependencies (e.g., identified vulnerabilities and what/who 
should build the redundancy into the system). The State is also building shared 
capabilities across local utilities to create local resilience, meaning the utilities are 
not just dependent on the State. 

o Utilities are examining next generation resilience practices from outside the sector. 

o The Water Sector needs to examine how to prioritize the allocation of scarce 
resources needed to sustain service during major events. There will be political 
perspectives on which systems will need to be prioritized first. 

o The scarce supply of fuel will be a major challenge. Multisector disruptions will draw 
heavily on the Energy Sector. 

o There is a growing amount of data from NOAA on climate change, and the ability to 
predict climate change effects is improving. However, there are data gaps for 
groundwater. Water management is very local and data may be difficult to obtain. 

o Governments expressed the need for integrated water management approaches to 
better prepare for resilient systems, particularly for extreme weather events. 

o Creating regional organizations that are united by factors such as customer base and 
water source can spread out costs on improvement/risk-management and storage 
projects, help avoid utility hikes (especially for small companies), and result in a 
more regional approach to water. 

Although change is occurring at the local level, the overall vision for resilience must come from 
the Federal level. Action is needed in laws, regulations, authorities, and standards; policy and 
funding; risk and vulnerability assessments; cybersecurity practices; response and recovery 
practices; and coordination across sectors and regions. 

The Federal Government can support resilience by communicating the need for resilient 
infrastructure. This includes leading a "clean water revolution" (supporting investments, 
funding, and research). 
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Federal laws and regulations should be evaluated to determine what currently applies, what 
should be modified, where overlaps exist, and how they should be modified to allow for 
new technologies and new ways to improve Water Sector security and resilience. 

o Laws and regulations such as the Clean Water Act, Safe Drinking Water Act, and 
Endangered Species Act were effective when they were first enacted more than 40 
years ago. Today, however, they are making it difficult for agencies to adapt to the 
changes that are needed because of climate change. 

o Flexibility in water quality would allow stressed systems to recover faster. Short¬ 
term discharge of impaired water and delivery of less-than-drinking-water quality 
water for other uses than human consumption could facilitate a staged recovery. 
However, a realistic assessment on what is practical in extreme weather 
emergencies is needed. 

o Regulatory approval processes to build infrastructure can be lengthy and expensive. 
One solution could be a multiagency project team with representatives across 
Federal departments to facilitate collaborative problem solving. 

o Regulations on co-generation should enable water utilities to set up energy 

resilience programs without barriers. This issue is not specific to the Water Sector; 
other facilities (e.g., hospitals, police stations, community centers, evacuation 
centers) could benefit from regulatory. 

o If a high-level position is established at the White House to coordinate water issues, 
the position requires statutory authority over budget, training, and agency activities 
to be effective. 

Resilience varies between utilities. Federal resilience polices should be written to allow 
flexibility to capture these variances and to address unique needs. Guidance, tools, and 
information do not always reach the local level. 

o For example, water utilities are often located in flood plains and are built to sustain 
once-in-100-year floods. Superstorm Sandy nearly topped a wall built to withstand a 
500-year flood. Standards need to be adjusted. 

o A Federal guidance document (e.g., an EPA best practices compilation) should allow 
organizations to identify ways to address resilience at the local level. 

o Federal agency (e.g., FEMA, U.S. Department of Housing and Urban Development 
(HUD), EPA, and USACE) standards need to be reconciled. 

Federal financial assistance should require recipients to meet conditions that encourage 
innovation and resilience (e.g., incentives using scoring criteria and measures). 

o The concepts of preparedness and flexibility need to be introduced into State, 
regional, and local systems. Otherwise, investments may be hard to defend. 

o EPA has clarified eligibility for certain funding streams, such as the State Revolving 
Funds, to include resilience projects. 
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o Federal funding driving resilience is only one issues as smaller/rural utilities do not 
use Federal funding streams. Procurement policies (at all levels of government) 
need to be updated to allow for easier transition to newer/resilient practices and 
vendors. 

• Programs should aid low-income customers: 

o Utilities should be transparent about how service fees are used, including what rate 
increases will finance and the schedule of improvements. 

o A program like the Low Income Home Energy Assistance Program (LIHEAP) could be 
implemented in the water industry. 

o Current program examples include waiving a portion of service fees, providing 
discounts, and accepting voluntary donations to reduce the cost of water for low- 
income individuals: 

■ The U.S. Department of Health and Humans Services (HHS) Office of 
Community Services (OCS) programs provide capital assistance for utilities 
with low-income customers. 

■ The American Water Company of Pennsylvania and the Baltimore, Maryland 
Department of Public Works both have low-income assistance programs. 

■ Detroit, Michigan has a grassroots program that collects donations that help 
people who have problems paying their water bills. 

■ Information on smart meters, retro fitting old devices, and other 
conservation efforts should be provided. 

The Water Sectors should address issues that impact multiple sectors or a region, such as 
risks and cascading failures. 

o After the September 11 th attacks, to address concerns about the security of 
water/wastewater facilities, EPA issued a series of requirements for facilities to 
conduct vulnerability assessments. This is an example of Federal activity affecting 
the local level, which resulted in regular assessments. 

o The Dams Sector identified a need for a common baseline to compare different risk 
environments. As a result, the Federal Guideline for Dam Safety Risk Management 
was created to set industry standards. 

o The Hydrologic Engineering Center (HEC) software programs can inform local 
municipalities and impart confidence about water surface elevation. That is useful 
for local emergency plans, enabling them to forecast events. 

Cybersecurity is a multidimensional challenge that cannot be resolved by one utility. The 
Federal Government can promote effective cybersecurity best practices and ways to 
mitigate risk throughout the sector, while supporting a coordinated sector approach to 
cybersecurity. All sectors need to modernize systems and increase cybersecurity. 
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o Federal cybersecurity capabilities are helpful and additional resources (e.g., tools, 
guidance) are needed. Examples include DHS risk assessments, Control Objectives 
for Information and Related Technology (COBIT), IT Infrastructure Library (ITIL) 
security management, the DHS Daily Open Source Infrastructure Report, and DOD 
programs/capabilities. 

o The Federal Government can develop and socialize solutions to reduce system 
penetration from external sources. This may entail establishing a front-line of 
defense against immediate threats (e.g., situational awareness of network 
vulnerabilities, threats, and events), increasing countering capabilities and supply 
chain security for key information technologies, expanding cyber education, 
coordinating research and development, and defining and developing strategies to 
deter malicious cyber activity. 

o A vulnerability assessment for smaller companies can help to determine their 
current level of cybersecurity risk. 

o Vendors address security differently and a consolidation of vendor cybersecurity 
practices would be helpful, particularly in addressing international vendors—what is 
acceptable in Germany may not be acceptable in the United States. 

The Water Sector should support cross-agency and cross-sector collaboration. Resilient 
water systems are a shared endeavor. 

o It is a challenge to unify Federal, State, and local government efforts. 

o Changing the approach to look at the whole system could make emergency 
response and recovery funding easier to obtain. 

o The FEMA administrator is a centralized role that could take on more pre-event 
planning. During Hurricane Sandy, the FEMA Administrator kept governors updated 
on restoration, planning, and operations efforts. This practice should continue to 
ensure coordination of all key players. 

o National, State, and regional plans needs to outline pre-event collaboration with 
water and wastewater utility owners. 

o Federal agencies (e.g., EPA, Bureau of Land Management (BLM)), the Water Sector 
Coordinating Council (SCC) and Government Coordinating Council (GCC), and trade 
associations could jointly lead collaboration and disseminate resilience guidelines 
and best practices. EPA is disseminating guidance on what constitutes a robust 
resilience plan. 

o There is a need for regional joint capacity planning with the Water and Energy 
Sectors to manage the assumption that each other's supply will always be there. 

o The U.S. Department of Transportation (DOT) and EPA could jointly provide regional 
planning. 
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o Federal and State governments can partner with local utilities. Communities are 
willing to do more, but they need guidance and information (e.g., hearing about 
best practices, including from the private sector). 

The Defense Industrial Base Sector can support efforts to mitigate effects to public health 
and safety. 

o Federal, State, and local emergency managers should lead response efforts and 
facilitate dialogue with any military response. 

o The National Guard can mitigate the effects of a Black Sky Event by providing 

drinking water and addressing other immediate public health needs. When there is 
a wide-spread attack on infrastructure a State's governor can call on the 
Quartermaster Corps within the National Guard to supplement replacement facility 
parts. 

o Military installations regularly rely on close collaboration with the utilities, and 
mutual understanding is critical. The National Guard has systems that can convert 
raw water to water and transportation support capabilities, and can conduct debris 
removal work. There are opportunities for DOD to support industry. 

o There is ambiguity on what authority has decision-making power on water rights. 
Individual States believe they have final say in water rights. But the Federal 
Government believes it has Federal Reserve water rights. Constitutional tension 
could affect water supply in a crisis. 

o Water and water infrastructure is extremely complex because most owners are local 
municipalities. As a result, there is not a direct Federal role. 

o The USACE's involvement is often in response to disasters. USACE focuses on a 
systems approach with Federal and civilian infrastructure working in tandem. 
Following Superstorm Sandy, the Federal Government was operating under the 
National Response Framework. As the lead for ESF#3, the Corps was working closely 
with EPA to help a wastewater treatment facility return to operations. 

• FEMA plays a key role in response and recovery: 

o FEMA is chair of a group established under Presidential Policy Directive 8 (PPD-8). 
This Mitigation Framework Leadership Group is an interagency group that also has 
State and local representatives. It is tasked with using the Federal Government's 
resilience and mitigation approach. The group works to establish standards, 
including executive orders related to Flood Standards (EO 13690), Seismic 
Standards, and Wild Urban Interface related to fire. 

o Projects built with the help of Federal investments must be built to withstand future 
events. FEMA can ensure the projects meet standards. 

o FEMA should make sure there is flexibility in the recovery process so that 
communities can rebuild in a manner that promotes resilience. 
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APPENDIX C. 

DISRUPTION SCENARIO CASE STUDY 


In order to help inform the National Infrastructure Advisory Council's (NIAC) Working Group 
recommendations to the full Council, the Study Group was tasked with assessing resilience during a 
high-impact scenario to identify challenges and opportunities. To that end, the Study Group 
designed a case study workshop that assessed water system resilience under five different 
disruption scenarios encompassing various regions and levels of disaster scale (local, State, and 
regional) and both manmade and natural hazards. The five disruption scenarios were selected due 
to their applicability to the Study Group's task and information learned during the Study Group's 
discussions, as well as being consistent with risk areas identified in the 2015 Water and Wastewater 
Systems Sector-Specific Plan (2015 SSP). 

Workshop participants included Study Group members and additional subject matter experts with 
experience in sector and cyber-physical dependencies, cybersecurity, natural disaster response and 
planning, and information sharing. To enable a robust discussion, participants were provided with 
comprehensive background information on the disruption scenarios and common resilience themes 
across the scenarios. The disruption scenarios covered the following risk areas: natural disasters, 
cybersecurity, and energy disruptions. The following five disruption scenarios were discussed during 
the workshop: 

• Natural Disasters 

o Midwest Floods of 2008 
o Superstorm Sandy 
o New Madrid Earthquake 

• Cybersecurity 

o Cyber-based Attack 

• Energy Disruptions 

o Northeast Blackout of 2003 

Section I of this appendix summarizes the results of the workshop. Section II provides the analysis of 
the five disruption scenarios in greater detail, including an examination of disruption impacts, 
dependencies, gaps and challenges, and opportunities. 

I. WORKSHOP RESULTS 


The workshop focused on identifying common resilience themes and uncovering gaps, challenges, 
and opportunities. This section highlights information learned from the workshop discussion, 
providing insights and perspectives on Water Sector resilience issues. It is organized by five major 
themes of Water Sector resilience: 

• Priority as a Critical Sector and Valuation of Water Services 

• Greater Investment in Resilience 

• Changing Risk Environment 
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• Regional Disaster Preparedness 

• Federal Support for Resilience 

PRIORITY AS A CRITICAL SECTOR AND VALUATION OF 
WATER SERVICES 

Water utilities should be a "tier 1" priority for power restoration after a disruption. 

After a large-scale disaster, supply chain challenges proliferate and there is no formal 
prioritization of resources (generators, pumps, fuel) to support the Water Sector. The 
situation is further complicated by disrupted sectors connected to the Water Sector supply 
chain; for instance, transportation (e.g., transporting equipment for recovery) and chemical 
(e.g., chemical procurement challenges). 

o Resource prioritization is a direct output of the partnership model. Some utilities 
work with the State emergency management office, Federal Emergency 
Management Agency (FEMA), U.S. Army power teams, and adjacent utilities to 
receive prioritized resources. 

o Local/State emergency managers should champion both prioritization and holding 
cross-sector workshops and exercises. 

Robust communication (i.e., with the public, media, local government, local utilities) is 
important to not only convey information during times of emergency but also the overall 
value of water services. 


GREATER INVESTMENT IN RESILIENCE 

More advanced water utilities should develop emergency resource request templates for 
and build information-sharing relationships with smaller, local utilities. 

Personnel represent a critical point in response/recovery and greater personnel investment 
is needed. Employee assistance programs (e.g., interest free home preparedness loans, 
food/gas/toll support) enable personnel to report to work during times of disruption. 

Greater investment in the sectors with a nexus to water infrastructure is needed (e.g., 
investing in the power grid, or facilitating public health sector exercises on water outages). 

Within the past 15 years, there has been a major push for earthquake preparedness causing 
earthquake preparedness gaps to close. Earthquake science has also improved and there is a 
better understanding of the risk. This success can be applied to other risk areas. 

Typically, utilities plan for a three to seven day power outage. There is a need for utilities to 
plan for short-, medium-, and long-term power outages. 

Utilities can invest in infrastructure resilience using the worst historical case; however, the 
risk environment changes and as such, utilities should consider investing/building-in 
resilience beyond the worst case. 
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CHANGING RISK ENVIRONMENT 


One water utility designed two-way lines of communication between the utility and 
State/local emergency management agencies. It is intended to expedite resources and de¬ 
conflict emergency response activities. 

Utilities need an appropriate framework to help them examine short- and long-term risks. 

• Improved risk communication (e.g., flood risk) is needed. 

Water facility access issues significantly complicate recovery operations. These include 
access control and credentialing for water utility personnel, security infrastructure losing 
power, and transportation issues. 

• The following represents information related to water cybersecurity issues: 

o The Water Sector can leverage cybersecurity lessons learned from the Energy 
Sector, for example their cyber-physical exercises. 

o Cybersecurity awareness throughout the utility (e.g., for all engineers, operators, 
and decision-makers) is limited. 

o Utilities do not have clear governance related to the management of cyber systems 
and incident preparedness and response roles/responsibilities. 

o Control system engineers see cybersecurity as "redundant" (i.e., ensuring 
continuity) and not "resilience" (i.e., preventing cyber incidents). 

o There are many systems and cyber processes and people supporting them; and as 
such, there are many points of vulnerability to control. 

■ The U.S. Department of Homeland Security (DHS) can assist water utilities 
with identifying vulnerabilities. 

o Depending on information access levels (e.g., clearances), utilities may be 
information-rich (bordering on inundation) or information-poor. However, all 
utilities struggle with operationalizing cyber threat information and generating 
concrete threat-response actions. 

■ Some utilities are also reluctant to share vulnerability and incident-learned 
information or join information-sharing networks. 

■ There is a limited group of personnel intersecting the understanding of 
water utilities and cybersecurity. If there is a major, coordinated cyberattack 
on utilities there may not be enough available personnel to respond. 

■ Utilities are unable to offer competitive packages to attract top 
cybersecurity experts. 

o Water utilities would greatly benefit from conducting cyberattack disruption 
exercises, during which they have to run their utilities manually. 

o Technology changes rapidly, resulting in frequent updates and increased 

opportunities for building-in resilience into cyber systems or falling farther behind. 
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REGIONAL DISASTER PREPAREDNESS 


Regional natural disasters (e.g., major floods) are infrequent and utilities are not able to 
assure power supply (e.g., fuel storage limitations and electricity is perishable). 

o Preparations are difficult. 

o Everyone needs the same resources, at the same time. 

Utilities should conduct the following regional event preparedness actions: 

o Establishing relationships with adjacent utilities for resources (e.g., personnel, 
equipment) during an emergency. 

o Pre-identifying resource needs, such as resources for minimum operations, and 
developing contracts to secure those needed resources. 

o Issuing purchase orders in advance to pre-approved vendors, enabling the vendor to 
move quickly. 

o Meeting with stakeholders (e.g., customers, local government, communities, 
emergency services) to communicate water utility recovery objectives and system 
outages, in the event of a major disruption. 

Additional exercises are needed within the Water Sector and in coordination with other 
sectors, in particular those that the Water Sector depends on (Chemical, Energy, 
Communication, and Transportation Sectors). This enables utilities to understand 
roles/responsibilities and identify 'choke points' in the system and system risk. 

o Exercises can be convened through the following: Local interdependent utilities 
convening themselves, local city/county emergency management, State lifeline 
infrastructure resilience councils, or FEMA. 

FEDERAL SUPPORT FOR RESILIENCE 

The Water Sector's ability to construct dedicated power-generation sources is also 
constrained by investment challenges. Utilities are supporting generation equipment for 
something infrequent, which competes against dollars for aging infrastructure and more 
immediate needs. 

Regulatory flexibility is critical to navigating disruptions. During emergencies, water utilities 
need to maximize their operations to minimize down-stream disruption impacts (e.g., public 
health impacts). 

o There is a need to continue the dialogue regarding regulations that prohibit 'smart' 
emergency responses. 

A lot of cybersecurity information is shared with the sector, but utilities need more 
actionable information and guidance on what to do with this information. 
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II. DISRUPTION SCENARIO ANALYSIS 


In support of the Study Group's tasking to consider Water Sector resilience related to a high-impact 
scenario, an assessment was conducted on available high-impact scenarios. Scenarios were selected 
based on their strong applicability to the Study Group's charge, as well as relevancy to key Water 
Sector resilience issues uncovered during Study Group panel discussions. This section summarizes 
the disruption scenarios which were examined, highlights common resilience themes across all five 
scenarios, and provides a synopsis of the core disruption aspects for each scenario. 

DISRUPTION SCENARIO SUMMARY 

Natural Disasters 

Midwest Floods of 2008 (Actual Scenario) 63 

Hazard Type: Natural Disaster, Flooding 

Key Characteristics: Heavy rainfall generates flooding exceeding historic flood levels in Idaho and 
southern Wisconsin, with some areas falling outside of the 100-year floodplain. Four wastewater 
facilities in Southern Wisconsin were examined. 

Superstorm Sandy (Actual Scenario) 64 

Hazard Type: Natural Disaster, Hurricane/Superstorm 

Key Characteristics: In October 2012, Superstorm Sandy made landfall in New Jersey. The storm 
surge rapidly inundated infrastructure, particularly wastewater sites. Relevant information from 
three New Jersey wastewater facilities, District of Columbia Water and Sewer Authority (DC Water, 
combined drinking water and wastewater treatment facility), New York City Drinking Water, and 
other water utilities participating in water response networks were examined. 

New Madrid Earthquake (Fictional Scenario) 65 

Hazard Type: Natural Disaster, Earthquake 

Key Characteristics: A major earthquake (7.7 magnitude) strikes the Central U.S. region—a region 
with un-reinforced infrastructure and a concentration of lifeline infrastructure. In areas within 
approximately 200 miles from the epicenter, drinking water and wastewater infrastructure is 
destroyed and service is unavailable to the vast majority of hospitals, government buildings, and 
communities, as well as for fire suppression. 


63 FEMA, Midwest Floods of 2008 in Iowa and Wisconsin, 2009. 

64 FEMA, Hurricane Sandy in New York and New Jersey, 2013; City of New York, A Stronger More Resilient New 
York, 2013; and AWWA, WARN: Superstorm Sandy After-Action Report, 2013. 

65 Mid-America Earthquake Center, Earthquake Hazard and Impact in the New Madrid Region; and Mid- 
America Earthquake Center, Impact of New Madrid Seismic Zone Earthquakes on the Central USA, 2009. 
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Cybersecurity 

Cyber Storm IV: Evergreen (Fictional Scenario) 66 

Hazard Type: Manmade, Cyberattack 

Key Characteristics: A cyberattack targeting infrastructure at the local level was exercised across 16 
States; focusing on State-level response and examining escalation from internal discovery to 
national information-sharing and remediation considerations. 

Energy Disruption 

Northeast Blackout of 2003 (Actual Scenario) 67 

Hazard Type: Manmade, Energy Disruption 

Key Characteristics: A cascading outage of electric transmission and generation facilities produced a 
blackout of most of New York, as well as States in the Northeast and Midwest and Canada. A water 
supply district in Cleveland, Ohio—providing drinking water to 1.5 million people—was examined. 

COMMON RESILIENCE THEMES 

The following are key themes that crosscut the five scenarios. 

The energy-water nexus and its potentially adverse impacts on water utilities during a 
disruption is the most common theme across both manmade and natural disasters. 

Elevating the priority status of the Water Sector is a common after-action need, particularly 
as it relates to the energy-water nexus. 

Energy, Transportation, and Communications Sectors are ones that water utilities depend 
on for disruption response and recovery. The public health sector experiences the greatest 
downstream impacts from water disruptions. 

Major disruptions were beyond the capacity of the water utility to exclusively resolve and as 
such, water utilities relied on external resources and coordination with other water utilities, 
sectors, and emergency management. Across all disruptions, it was evident that additional 
pre-event relationship-building, exercising, and understanding roles/responsibilities would 
have improved disruption management. 

Timely, accurate information sharing to the public, media, and emergency management 
liaisons is critical to ensure public health and safety, mitigate panic, and facilitate response. 
Risk communication is essential. 

Utilities will experience major impacts if their infrastructure is not built to withstand 
impacts from a low-probability, high-impact event (e.g., major flooding). 

Water facility access issues significantly complicated recovery operations. These include 
access control and credentialing for water utility personnel; security infrastructure losing 
power; and transportation issues. 


66 DHS NCCIC, Informing Cyber Storm V: Lessons Learned from Cyber Storm IV, 2015. 

67 Center for Infrastructure Protection and Homeland Security, GMU, Blackout, 2013. 


NIAC Water Sector Resilience Final Report and Recommendations 


85 





Personnel represent a potential point of failure in response and recovery, as they can also 
be significantly impacted by major disruptions and unable to reach the facility. Once at a 
facility, they must be assured of personal safety along with food and drinking water. 

OVERVIEW OF DISRUPTION ASPECTS 

This section examines the five scenarios with response to four topics: 

Scenario Impacts - Key scenario information, inclusive of economic and physical 
infrastructure effects. 

Dependencies - Points of failure in processes, communication, or infrastructure leading to 
disruption in the Water Sector 

Gaps and Challenges - Complications and obstacles experienced or uncovered during or 
after the Water Sector disruption 

Opportunities - Lessons learned information or expert-suggested actions, which could 
improve Water Sector security and resilience 

Scenario Impacts 

2008 Midwest Floods - Region: SE Wisconsin 

• Iowa and Wisconsin reported billions in economic and agricultural losses 

• One wastewater facility sustained $2 million in damages 

Flooding occurred above record stage and outside 1-percent-annual-floodplain-chance 
Plant inundation (from surface flows and river flooding) generated a complete plant 
shutdown 

It took two days to remove floodwaters from wastewater facilities; they were able to 
operate on permanent power two weeks later 

Personnel abandoned sites for safety; some facility access roads were impassable 
Emergency generators could not run due to water inflows, shut off fuel supplies, and 
transport issues 

2012 Superstorm Sandy - Region: Northeast (NY, NJ, DC) 

Over 8.5 million people with no power; estimated $71 billion in damages; at least 162 dead 

• Transportation corridors, roads, tunnels flooded—causing fuel shortages 

Power restored within hours to days but damaged power systems caused recovery delays; 
e.g., in Howard County, MD, loss of power resulted in release of 25 million gallons of raw 
sewage 

10 of 14 New York City wastewater plants released partially treated/untreated sewage into 
local waterways; 42 of 96 pumping stations damaged 

Storm surge rapidly inundated wastewater sites, preventing planned actions (e.g., de¬ 
energizing plants) 

• Equipment and systems damaged by floodwater, delaying recovery 
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New Madrid Earthquake - Region: Central U.S. (Fictional Scenario) 

2.6 million households without electricity and 1.1 million households without water 
Within 200 miles of epicenter, drinking water and wastewater service unavailable to the 
vast majority of hospitals, government buildings, and communities 

• 86,000 casualties and 3,500 fatalities 

425,000 breaks to utility pipelines; nearly 715,000 damaged buildings; over 3,500 damaged 
bridges 

• $300 billion in direct economic loss 

• More than 730,000 people permanently displaced 

• Limited medical, firefighting, and law enforcement services 

Cybersecurity Incident (Fictional Scenario) 

• Not Available - impact information not disclosed in public report 

2003 Energy Blackout - Region: Cleveland, OH 

Large portions of Ohio, Michigan, Pennsylvania, Massachusetts, New York, Connecticut, New 
Jersey, and Ottawa, Canada were without power 

• 50 million people affected 

• Economic impact is estimated to be $4 billion to $6 billion for affected regions 

In the greater Cleveland area, it took 30 hours to restore power; and in NYC, it also took 30 
hours 

Approximately 80 percent of the Cleveland water distribution system experienced partial 
outages 

• Boil advisories are issued, impacting a majority of service customers 

Dependencies 

2008 Midwest Floods - Region: SE Wisconsin 

• Transportation 

• Energy 

• Public Health (downstream disruption) 

• Emergency Services to navigate access challenges 

• Communications to disseminate information 

2012 Superstorm Sandy - Region: Northeast (NY, NJ, DC) 

• Energy-particularly electricity and fuel supply 

• Transportation corridors 

• Communications 

New Madrid Earthquake - Region: Central U.S. (Fictional Scenario) 

Nearly all critical infrastructure, particularly: Energy, Transportation, Communications, 

Public Health (downstream), and Information Technology 
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• Personnel are unable to reach the facility, taking care of their own families 

Cybersecurity Incident (Fictional Scenario) 

• Internal/external system (e.g., cyber, physical) dependencies 

• Communications 

2003 Energy Blackout - Region: Cleveland, OH 

Energy-water utilities were disrupted due to a massive cascade of external failures 

• Information Technology 

• Communications 

• Personnel 

Gaps and Challenges 

2008 Midwest Floods - Region: SE Wisconsin 

• Wastewater facilities are located in low-lying areas prone to flooding 

• Flooding recurrence levels are difficult to predict 

• Transportation challenges in accessing flooded water facilities 

• Fuel challenges—local fuel stations were out of service 

Power generation challenges—original and back-up generators were flooded, inoperable; 
offsite power utilities were disrupted 

• Backup equipment had been installed below base flood elevation 

2012 Superstorm Sandy - Region: Northeast (NY, NJ, DC) 

Wastewater facilities are located in flood zones, near major bodies of water 
Unprecedented storm surge and debris was beyond the capacity of the sewer/wastewater 
system to perform 

Essential and backup equipment had been installed below base flood elevation 

• Permanent generators (in-place) were uncommon 

• Lack of support for power and fuel requests 

• Loss of electricity meant water supplies could not move through high-rises 

• Radio/communication lines were temporarily lost 

• Key transportation corridors, access roads were flooded 

Access control issues limited utility personnel's damage assessment and repairs 

New Madrid Earthquake - Region: Central U.S. (Fictional Scenario) 

Entire water infrastructure within 200 miles of epicenter suffers major damage 

• Water storage tanks collapsed and limit planned water supplies 

• Wastewater overflows into buildings and spills into nearby water bodies 

• Impassable roads and highways block access to many facilities 

• Communications are all but eliminated 
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• Local equipment to repair infrastructure are damaged 

Chemical storage tanks and piping have ruptured, creating hazardous materials spills 
Large numbers of water and wastewater personnel are not at work because they are dealing 
with family issues and the loss of homes and schools 

Cybersecurity Incident (Fictional Scenario) 

Major system dependencies exist, and taking systems down or bringing them up requires 
major coordination and collaboration 

There was uncertainty regarding when to communicate, what to communicate, and with 
whom 

• Legal and authority questions challenge public and private interactions 

• Escalating cyber emergencies 

• Resource allocation procedures absent or inadequate 

• Federal emergency response authorities unclear during a major cyber event 

• Gaps in communication, responses plans, and resources were identified 

2003 Energy Blackout - Region: Cleveland, OH 

Dependence on national power grid is a major vulnerability and there is a lack of 
understanding of the grid's complexities and connections 

Offsite networks and IT systems had to be powered down due to danger of overheating 
Back-up generators were limited and what exactly was connected to them was unknown 
Logistical issues (establishing a chain of command in decision-making, overworked 
personnel, deploying staff to field offices, availability of knowledgeable staff onsite) had to 
be quickly overcome 

• Security gates lost power 

Opportunities 

2008 Midwest Floods - Region: SE Wisconsin 

Locate critical facilities outside 2-percent-annual-chance flood hazard area; if not possible, 
protect equipment to that level 

Use flood damage-resistant material and construction practices to reduce losses and 
facilitate cleanup 

• Reduce direct inflows to prevent overwhelming operational equipment 

• Coordinate with major users to reduce demand on facility 

Issue information bulletins to encourage the reduction of water use and sewage flows 
Develop emergency operations plans and checklists (e.g., contact information) for all 
facilities 

Plan to stage emergency equipment (e.g., pumps, generators, fuel) outside of mapped flood 
hazard area 

• Place stronger emphasis on flood risk communication 
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2012 Superstorm Sandy - Region: Northeast (NY, NJ, DC) 

Improve Energy Sector communications; coordinate with utilities to improve reliability 

• Make Water Sector power restoration a priority for all power providers 

Establish Water Sector support and define roles/responsibilities for Emergency Operations 
Centers (EOCs) 

• Form pre-defined response teams for various events; determine roles 

Protect key infrastructure to a higher risk, lower probability flood event (e.g., 500-yr flood) 

• Develop a flood protection strategy for all facilities (central, offsite) 

• Conduct pump-station power loss exercises 

• Develop a plan to secure critical equipment (trucks) and fuel after storm 

• Invest in staff support (food, gas/toll support, temporary shelter) 

• Work with local/State/regional planners and responders 

• Federal response partners to ensure water utility personnel have site access 
Increase participation in Water/Wastewater Agency Response Network (WARN) and 
Emergency Management Assistance Compact (EMAC) 

• Develop a more systematic process to gain utility operation status 

Address communication system interoperability issues; ensure internal/ external 
communications 

New Madrid Earthquake - Region: Central U.S. (Fictional Scenario) 

Implement and support a continuous planning and exercise event cycle for major regional 
events 

• Continue the interregional and Federal planning effort 

• Focus on senior leadership involvement in catastrophic planning 

• Develop a comprehensive lifelines recovery strategy 

• Continue disaster air operations planning 

Examine emerging technologies to enhance recognition, warning, and post-event 
information sharing 

Cybersecurity Incident (Fictional Scenario) 

Define dependencies in advance, identify critical systems, and develop communication/ 
coordination planning 

• Clearly define roles/responsibilities and an incident command structure 

Ensure cyber plans include: response and recovery processes/procedures, contingency 
plans, coordination guidance, prioritization of mission critical systems, and information¬ 
sharing protocols 

• Increase familiarity and exposure to cybersecurity issues (e.g., threats) 

• Promote ongoing training to keep staff knowledge levels current 

• Identify and understand available resources prior to an incident 
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2003 Energy Blackout - Region: Cleveland, OH 

• Share information on national power grid dependencies 

Identify options for dedicated service, priority service, and other agreements with power 
suppliers 

• Define decision-making process and roles/ responsibilities 

• Establish an EOC for each offsite facility 

Develop protocols and ready-made templates for internal, external and public/media 
communications 

• Ensure sufficient equipment for handling logistics and communications 

Have an EPA or State representative onsite to provide the 'other side' of disruption impacts 
Develop protocols and ready-made templates for internal, external and public/media 
communications 

• Establish a public call center and regular communication with media 

Address security concerns (e.g., backup power for security gates) and establish procedures 
to avoid dissemination of critical facility information 
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APPENDIX D. 

STUDY GROUP FINDINGS AND CONCLUSIONS 


The Working Group formed a non-NIAC-member Study Group to examine specific technical, 
financial, and operational issues. Specifically, the Study Group was tasked to: 

• Identify baseline resilience of the sector 

Identify the risk profile of the sector including current, emerging, and long-term risks and 
the strategies and practices the sector is implementing to mitigate them 
Identify unique factors within the sector that influence risk mitigation, including investments 
and operational decisions 

• Identify gaps in resources and practices, and opportunities to remedy them 

• Summarize research and interviews into key findings and conclusions 

Prepare a summary report of Study Group findings and conclusions to the Working Group 

Exhibit D-l shows the formal entry point for the Study Group report that was invaluable during the 
analysis and deliberations phase. This Study Group input, in addition to the Working Group's 
expertise and experience, interviews with subject matter experts, extensive literature reviews, and 
comprehensive research resulted in a well-documented report. 

Exhibit D-1. Overview of Working Group and Study Group Efforts 
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The Study Group has developed six main findings: 

Water is not given appropriately high priority as a critical sector. 

• Water services are undervalued. 

Greater investment is needed to improve Water Sector resilience. 
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A dynamic risk environment requires sustained research and analysis to support risk 
management. 

Regional collaboration is highly valuable but effectiveness requires expanded support. 

• Federal program support for resilience is fragmented and weak. 

These findings and their related conclusions are presented below. 

Study Group Finding 1: Water is not give appropriately high priority as a critical sector. 

The Water Sector's role as a lifeline sector is not sufficiently recognized—and acted upon—by the 
majority of stakeholders at the local, State, and national levels. This is a fundamental failing, as 
multiple sectors are critically dependent on water, and water is arguably the single most important 
resource for community health and well-being. Enhanced coordination across sectors on planning 
and prioritization of resources needed during restoration is needed to support the sector as a 
national priority. 

Specific challenges include: 

Continuity of water services requires a full spectrum of resilient activity rather than simply 
focusing on response. This is not yet fully understood by the public or decision-makers. 

Planning for larger-scale (multicommunity, multijurisdiction) supplies of emergency drinking 
water is inadequate; the capability of individual States to effectively deliver needed water is 
limited. 

Cascading effects of disruptions among critical sectors are not fully understood or valued, 
particularly during major disasters when all critical services are being stressed. 

Service restoration requires improvement in coordination and communication between the 
Energy and Water Sectors. 

Current authority for water is distributed across four Emergency Support Functions (ESFs) 
under the National Response Framework and multiple Federal agencies, leading to 
uncertainty, leadership challenges, information-sharing complications, and an overtaxing of 
Water Sector response resources—all of which can impede water service recovery during 
disasters. 

Study Group Conclusions: Opportunities to Increase the Priority of Water 

A. Treat water and wastewater services as a first-tier national priority across the full spectrum 
of for preparedness—prevention, protection, response, mitigation, and recovery—as 
defined in Presidential Policy Directive 8 (PPD-8). 

B. Examine the Federal/State capability in providing emergency water supplies under 
emergency conditions, particularly given recent events in Michigan, Ohio, and West Virginia. 

C. Build a shared understanding among critical interdependent sectors of assumptions, plans, 
capabilities, and prioritization of resources. 
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D. Facilitate coordination between water utilities, fuel and chemical providers, and law 
enforcement and emergency managers to increase awareness of and improve service 
restoration processes. 

E. Strengthen Federal coordination during emergencies and improve sector response, by 
streamlining and coordinating Water Sector emergency support functions (e.g., 
consolidating Federal assistance for the Water Sector under a single ESF). 

Study Group Finding 2: Water services are undervalued 

Water Sector services are often undervalued, if not simply taken for granted. Understanding, 
recognition, and support for the value of resilient water services is lacking by both the public-at- 
large and decision-makers. Proactive investments in resilience can produce order-of-magnitude 
savings compared to expenditures for emergency response and repair. However, this requires 
decision-makers who are willing to champion and fund resilience priorities, combined with 
underlying public support. 

Specific challenges include: 

The lack of appreciation is an underlying contributor to lack of support for infrastructure 
investment. 

Decision-makers at every level need to support system upgrades that build resilient capacity 
and encourage system redundancy. 

Public outreach and education is critical to build the case for investment. Improved 
understanding by the public—and elected leaders—is fundamental to taking effective and 
sustained action for resilience. 

The challenge of raising rates to meet actual short- and long-term needs—including 
resilience—is enormous. 

Study Group Conclusions: Opportunities to Appropriately Value of Water 

A. Conduct a full life-cycle cost/benefit analysis to demonstrate the overall value of 
infrastructure investment—in health, convenience, economic prosperity, and overall quality 
of life—and the payoffs associated with investment now to avoid more costly impacts later. 

B. Provide water utility decision-makers with specific and validated information to value water 
appropriately, about the positive cost/benefit characteristics of resilience investments, and 
to support and defend investments in system resilience. 

Study Group Finding 3: Greater investment is needed to improve Water Sector resilience. 

Enhancing resilience requires strategic investments in infrastructure, technology, and expertise, yet 
many water and wastewater systems are constrained making such investments, particularly in 
smaller utilities. While resources are often available for short-term operational needs, such as 
emergency response, investment in preventative measures has often been inadequate to ensure 
reliable service delivery under distressed conditions. Constraints include a lack of focus on full life- 
cycle costs for building resilient infrastructure, a deepening shortage of experienced personnel, a 
lack of awareness or availability of tools and information, and a concern by political leaders about 
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the impact of rate increases on low-income populations. Enhancing the ability of the Water Sector 
to make improved strategic investments can build resilience while complementing short-term 
operations. 

Specific challenges include: 

While capital is available to most systems, incorporating a full accounting of risk is difficult 
because rate-setting is often a political process. 

Water and wastewater utilities are highly diverse; some develop and implement leading- 
edge practices while others lack information, knowledge, expertise, tools, and lessons 
learned. Despite the criticality of sharing these resources, adoption of successful practices 
and resources has not been fully realized. 

Information and tools to understand risks and conduct risk assessments are available and 
valuable, but are currently underutilized throughout the sector due to lack of awareness. 

The adequacy of human assets within the Water Sector are a growing concern, particularly 
with regard to knowledge retention and talent acquisition. Challenges that require new skill 
sets and the costs of training constrain the ability to adapt to a changing environment. The 
loss of institutional knowledge due to retirements compounds this shortfall. 

The affordability challenge makes it difficult for some communities to have full-cost-of- 
service pricing. 

Study Group Conclusions: Opportunities to Increase Investment in Water Resilience 

A. Incorporate risk into financial decisions and capital investments in building and sustaining 
resilient systems as cost-effective solutions that balance short- and long-term needs with 
normal and distressed operations. 

B. Facilitate partnerships between water utilities, associations, and the private sector to 
educate and promote resource sharing and knowledge transfer (e.g., best practices and 
resilience case studies). 

C. Encourage mentorships between leading edge utilities and less-mature utilities—such as 
between large and small utilities—and facilitated by associations. 

D. Invest in the implementation (e.g., streamlining and increasing awareness) of currently 
available tools, especially standardized risk-analysis tools that inform capital project design 
and investment decisions, and ensure Federal agencies collaborate on tools to avoid 
duplication. 

E. Invest in job and training programs and technical assistance—in partnership with higher- 
education providers, nongovernmental organizations, and veteran's services—on the use of 
information and tools. 

F. Authorize and fund a financial assistance program, similar to the Low Income Home Energy 
Assistance Program (LIHEAP), to address the affordability challenge for disadvantaged 
populations. 
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G. Utilize asset management tools and green infrastructure approaches to increase 
investments in critical assets. 

Study Group Finding 4: A dynamic risk environment requires sustained research and analysis to 

support risk management. 

Water Sector partners recognize that planning for historic patterns of disruption do not fully account 
for changing and emerging risks. This situation is not exclusive to the Water Sector, as new and/or 
expanding threats (e.g., cyberattacks, aging and moving populations, and increasingly severe 
weather events) are becoming more prominent for all critical infrastructure. A dynamic risk 
environment requires continued research and analysis to improve confidence in long-term risk- 
management decisions, even while utilities struggle to meet the current demands of day-to-day 
operations. The cybersecurity challenge in particular will test the capabilities of risk-management 
processes, with the acquisition and retention of human-capital assets of particular concern. 

Specific challenges include: 

Despite the increasing unpredictability of extreme-weather events, systems may lack the 
advanced capabilities to adapt to a range of potential threats (e.g., rising sea levels, 
expanding populations in coastal areas, and more severe storms). 

Sector dependencies, while generally well-understood, may not be adequately addressed in 
practice. Planning may not address either the extent of the need for supplies or their actual 
availability. For example, the duration of events may be underestimated, and the existing 
supply chain planning for electricity, critical chemicals, and fuels may in fact be inadequate. 
In addition to underestimating need, shortfalls may reflect transportation difficulties as well 
as difficulties at the point of production or origin. Disasters are not single-sector events, and 
joint lifeline-sector planning is essential. 

While a broad range of information, tools, analysis, and research are available to utilities, 
broad use across the sector to manage risk lags due to the lack of investment in 
consolidation and awareness of these resources. 

The increasing prevalence of cyber intrusions challenges business-as-usual practices. 
Cybersecurity awareness throughout utility personnel (e.g., for engineers, operators, and 
decision-makers) is often limited. In addition, the number of available Water Sector cyber 
experts is insufficient for current needs; utilities are constrained in offering competitive 
packages to attract top cybersecurity experts. 

Study Group Conclusions: Opportunities to Increase Research and Analysis for Risk Management 

A. Assist water utilities in adapting to potential threats by research and providing actionable 
information (e.g., better understanding of emerging cyber threats and how to respond), 
access to analytic tools (e.g., for assessment of cross-sector vulnerabilities and 
dependencies), and best practices and guidance. 

B. Develop and update regularly a compendium of lessons learned, best practices, expert 
knowledge, and tools to support effective preparation and response for all threat types. 
Consolidate and broadly market these resources into a one-stop-shop for easy access by 
utilities. 
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C. Connect applied research to utilities, particularly in the areas of new technologies to 
support resilience and applying methods and technologies successful in other sectors to the 
Water Sector. 

D. Develop and offer to water utilities exercises on cyber disruption and manual operation to 
determine cyber system management governance and incident roles/responsibilities. 

Study Group Finding 5: Regional collaboration is highly valuable but effectiveness requires 

expanded support. 

Regional-level planning and response is a highly effective approach for enabling resilience through 
joint action. While there are some notable exceptions, systems within a region containing multiple 
local and/or State jurisdictions tend to plan and operate independently. Improved understanding of, 
and support for, effective joint action is needed among local, State, and national leadership. 
Collaborative planning, relationship building, resource sharing, and knowledge transfer can aid 
individual utilities while simultaneously contributing to shared resilience improvements and an 
integrated approach to preparedness. 

Specific challenges include: 

The lack of a broadly accepted framework for regional goals, resource-sharing criteria, and 
performance metrics hinders the development of a shared approach to disruption; such a 
framework is needed for all phases of resilience, not simply response. 

Although the consequences of a disruption of water and wastewater services are primarily 
local and regional, insufficient attention is given to the risk and impact of a large-scale, 
national disruption. 

Study Group Conclusions: Opportunities to Improve Regional Collaboration 

A. Develop and offer joint exercises—across jurisdictions and interdependent sectors, including 
chemical, energy, and transportation—to test and strengthen a regional resilience 
framework. 

B. Reinforce successful mutual aid and assistance models—such as the WARN—as mechanisms 
to address the full spectrum of resilience and physical and cyber asset challenges. 

C. Support knowledge transfer and resource sharing for the management of emerging threats 
and cyber vulnerabilities, such as through the WaterlSAC. 

D. Analyze the risk, impacts, and required actions associated with 1) a large-scale water or 
wastewater service disruption that requires the evacuation and relocation of large 
populations or 2) a widespread, coordinated cyberattack on utilities that stresses the 
capacity of cyber experts to respond. 

Study Group Finding 6: Federal program support for resilience is fragmented and weak. 

While resilience is well established in Federal policy (e.g., PPD-8), it has not been substantially 
integrated into the actions of Federal agencies. Resilient outcomes are not part-and-parcel of 
Federal guidance and resources. Reviewing statutes and regulations to support resilience, 
incentivizing resilience, and leading coordination are measures the Federal Government can take to 
actively implement resilience practices in accordance with Federal policy. 
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Specific challenges include: 

Federal authorities, regulations, reporting requirements, and funding mechanisms currently 
do not promote a unified response to the resilience needs of the sector. 

The sector's flexibility to operate during emergencies (e.g., water quality, power-generation 
sources) is constrained by regulatory requirements. 

Study Group Conclusions: Opportunities to Strengthen Federal Support for Water Resilience 

A. Focus resources, eliminate redundancy, and rationalize appropriate guidance, funding, and 
regulatory processes by examining the current structure of Federal authorities. 

B. Review current statutory and regulatory structures with the intent to promote, rather than 
impede, resilient activity, and encourage innovation and flexibility in regulatory compliance. 
For example, coordinate and streamline the permitting of resilience projects (such as 
advocated in Title XU of the Fixing America's Surface Transportation (FAST) Act) to enable 
more timely and effective planning and investment decisions. 

C. Provide utilities with the regulatory flexibility needed during emergencies to discharge 
water of a less-than-permit specification quality, or to generate power without having to 
operate as both a regulated water and power utility. 

D. Coordinate an approach across Federal agencies for nonregulatory programs that support 
resilience—such as grant funding requirements, streamlined project guidance, and 
education and knowledge transfer. 

E. Increase authorizations and appropriations for resilience activities through existing Federal 
programs such as the Clean Water State Revolving Fund (SRF), Drinking Water SRF, Water 
Infrastructure Finance and Innovation Act (WIFIA), and Water Resources Reform and 
Development Act (WRRDA). 

F. Continue tax-exempt status for municipal funding. 

G. Incentivize or reward resilience in local and State planning and investment decisions—based 
on State and local input—to provide a common foundation for resilience at local, State, and 
regional levels. 

H. Support pilot and demonstration projects that test innovative technology and provide 
funding mechanisms that reduce the risk to local, State, and regional decision-makers in 
adopting promising, yet unproven, innovations that could offer newer, better, and more 
cost-effective approaches to service delivery. 

I. Proactively lead collaboration among local, State, and Federal agencies and the Water 
Sector. 

J. Visibly support outreach and education efforts by informing citizens of the 
value/importance of water and water investments in a manner similar to fire-prevention 
and public health campaigns. Partnering with industry leaders and Water Sector associations 
would be a highly effective means of accomplishing this. 
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APPENDIX E. 

COMPENDIUM OF PRIOR RECOMMENDATIONS 

This appendix provides a listing of recommendations—previously released by the NIAC and other 
organizations—related to resilience in the Water Sector. The Council leveraged the knowledge and 
expertise of these organizations for the current NIAC study by identifying potentially significant 
insights from several associated studies. Exhibit E-l provides a timeline of prior recommendations 
that are most closely tied to the recommendations submitted by the Council in this study. These 
recommendations are further detailed in this appendix, organized into seven main themes: 

Cross-Sector Interdependencies 

o Identifying Interdependencies 
o Cross-Sector Engagement and Partnerships 

• Strategically Improving Water and Wastewater Infrastructure 

o Adopting Existing Frameworks for Resilience 
o Addressing Regulatory Policies Affecting Recovery 
o Focusing on Regional Needs 

o Facilitating Infrastructure Investments and Incentives 

• Complementary Public and Private Resilience Building 

o Improving Public-Private Partnerships 
o Fostering Senior Executive-Level Partnerships 

• Emergency Planning and Response 

o Conducting Cross-Sector Emergency Planning Exercises 
o Enhancing Critical Infrastructure Simulations and Analysis 
o Facilitating Regional Resilience Planning 
o Incorporating Lifeline Sectors in Emergency Operation Centers 
o Developing Access-Credentialing Solutions 

• Information Sharing 

o Improving Intelligence Information Sharing 
o Understanding Infrastructure Intelligence needs 
Cybersecurity 

• Capabilities to Address Emerging Issues 

o Examining Social Media Capabilities 
o Developing Simulation and Modeling Tools 
o Developing Design Standards and Best Practices 
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Exhibit E-1. Prior Recommendations from NIAC and Other Water Sector Sources 


Prior NIAC Recommendations 


2010 

DHS IP should lead a national effort to improve the understanding 
of resilient activities and how they are implemented in support of 
combined infrastructure and community resilience. 

(NIAC, Recommendation I, Optimization of Resources, 2010, p. 19) 

The NIAC should prepare a follow-up report to the July 
2009 Framework for Dealing with Disasters and Related 
Interdependencies and progress on the recommendation for DHS 
to elevate water services to its own ESF within the NRF to achieve 
higher prioritization of water systems during emergency response 
(NIAC, Recommendation 6, Optimization of Resources, 2010, p. 24) 


2013 


The Secretary of Homeland Security should facilitate efforts with 
governors, mayors, and local government officials to identify or 
develop regional, public-private, cross-sector partnerships, led by 
senior executives, to coordinate lifeline sector resilience efforts 
within a given region. 

(NIAC, Recommendation 2, Regional Resilience, 2013, p. 5) 


2014 


Determine the role of policies, regulation, and consolidation within 
industries and its impact on resilience, security, innovation, and 
resilience. 

(NIAC, Recommendation 1.3, CISR R&D Plan, 2014, p. 25) 


2015 


Incorporation of CEO-relevant roundtables to sector-specific or 
national exercises which will assist them to identify decisions or 
issues that their companies, and a sector as a whole, will need to 
manage from a financial, regulatory, operational, and reputational 
corporate risk level. 

(Recommendation 8.4. CEO Engagement, 2015, p.30) 



Prior Water Sector Recommendations 


State and local emergency operations centers must establish 
clearly defined roles and responsibilities for Water Sector support. 
Representation can be physical or virtual, but should include a 
member from WARN. 

(AWWA, Recommendation 6,WARN: Superstorm Sandy After Action 
Report, 2013, p. 3) 


Raise awareness of the Water Sector as a lifeline sector and 
recognize the priority status of its needs and capabilities, and 
support the development and deployment of tools, training, and 
other assistance to enhance preparedness and resiliency. 

(CIPAC Water Sector Strategies Working Croup, Roadmap to a Secure and 
Resilient Water Sector, 2013) 


Federal agencies and utilities should work together to better inform 
the public and communities about the need for resilience in water 
systems. 

(AMWA and NACWA, Recommendation 3.a. Water Resilience Summit, 
2014, p.A-4) 

Document Federal agencies with responsibilities for resilience, 
as well as existing partnerships involving Federal agencies and 
local utilities and communities. Analyze the Federal landscape for 
potential redundancies in resilience efforts and identify potential 
areas for collaboration. 

(AMWA and NACWA, Recommendation 4.a, Water Resilience Summit, 

2014,p.A-4) 

Federal and State agencies and utilities must look more holistically 
at regulations to ensure flexibility for resilience and to leverage 
opportunities that capitalize on multiple benefits for innovation (e.g., 
biosolids for energy). 

(AMWA and NACWA, Recommendation 2.a, Water Resilience Summit, 
2014, p.A-4) 
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I. CROSS-SECTOR INTERDEPENDENCIES 


The understanding of sector interdependencies—how events impacting one sector can cascade 
across other sectors, often in unexpected ways—is essential component for preparing for large-scale 
events. This area covers the identification of interdependencies, and the cross-sector engagements 
and partnerships to build the understanding needed to address these interdependencies. 

IDENTIFYING INTERDEPENDENCIES 

The President should task the NIAC to identify the highest-priority cross-sector risks 
affecting national security and resilience and produce a written report to the President 
within 18 months recommending potential executive-level, cross-sector action. (NIAC, 
Recommendation 1.3. Regional Resilience, 2013, p. 5) 

Emphasize cross-sector interdependencies and collaboration through the Sector Partnership 
Model: 

o The U.S. Department of Homeland Security (DHS) and other Federal organizations 
should increase resources to conduct cross-sector studies and analysis, guided by 
private sector knowledge of infrastructure operations. 

o Increase understanding of cross-sector interdependencies and capabilities, led by 
the sectors that have a well-established partnership and a strong security posture. 
(NIAC Recommendation 6 (with selected bullet point), Cl Partnership Strategic 
Assessment, 2008, p. 11) 

The national laboratories should focus their interdependency modeling and research on the 
regions and sectors whose failure would have the highest impact on the economy and 
national security. The Study Group suggests starting with modeling the telecommunications 
and energy sectors and the interdependencies among them and other critical infrastructure. 
In addition, existing research and development (R&D) studies need to be indexed and cross- 
referenced so that these materials are accessible to appropriate parties. (NIAC, 
Recommendation 9, Cross Sector Interdependencies, 2004, p. 11) 

The DHS Office of Infrastructure Protection (IP) should expand the provision of scalable, low- 
cost tools and techniques for community-level identification and assessment of 
infrastructure interdependencies. (NIAC, Recommendation 3, Optimization of Resources, 

2010, p. 21) 

The NIAC should prepare a follow-up report to the July 2009 Framework for Dealing with 
Disasters and Related Interdependencies and progress on the recommendation for DHS to 
elevate Water Services to its own Emergency Support Function (ESF) within the National 
Response Framework (NRF) to achieve higher prioritization of water systems during 
emergency response (NIAC, Recommendation 6, Optimization of Resources, 2010, p. 24) 

The interoperability of communication systems needs to see continued consideration based 
on vulnerability to service outages that can compromise operations and response 
effectiveness. This includes maintaining radio communication networks such as 900-MHz 
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systems. (American Water Works Association (AWWA), Water/Wastewater Agency 
Response Network (WARN): Superstorm Sandy After-Action Report, 2013, p. 4) 

CROSS-SECTOR ENGAGEMENT AND PARTNERSHIPS 

The Secretary of Homeland Security should facilitate the development of cross-sector 
partnerships within selected regions to improve the regions' resilience to very large-scale 
events that could impact national security, resilience, and economic stability. (NIAC, 
Recommendation 2.1, Regional Resilience, 2013, p. 5) 

Document Federal agencies with responsibilities for resilience, as well as existing 
partnerships involving Federal agencies and local utilities and communities. Analyze the 
Federal landscape for potential redundancies in resilience efforts and identify potential 
areas for collaboration. (Association of Metropolitan Water Agencies (AMWA) and National 
Association of Clean Water Agencies (NACWA), Water Resilience Summit: Summary & Next 
Steps, 2014, p. 4) 

Develop an intergovernmental partnership to address Water Sector adaptation and 
resilience needs in the face of changing weather patterns. (NACWA, Water Resources Utility 
of the Future: A Call for Federal Action, 2013, p. 3) 

II. STRATEGICALLY IMPROVING WATER AND 
WASTEWATER INFRASTRUCTURE 

Strategic decisions about the development, implementation, and application of regulations and 
investments directly impact the sector's resilience. Recommendations in this category recognize the 
complexity of this decision-making, and are organized into four focus areas: 

• Adopting existing frameworks for resilience 

• Addressing regulatory policies affecting recovery 

• Focusing on regional needs 

• Facilitating infrastructure investments and incentives 

ADOPTING EXISTING FRAMEWORKS FOR RESILIENCE 

Promote the use of the NIAC-developed framework for setting resilience goals in the critical 
infrastructure and key resources (CIKR) sectors and for providing a common way to organize 
resilience strategies within the Federal Government, State governments, and CIKR sectors. 
(NIAC, Recommendation 5, Establishing Resilience Goals, 2010, p. 52) 

Fortify government policy framework to strengthen critical infrastructure resilience: 

o The President should adopt the NIAC definition for resilience for development of 
resilience policy. 
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o Government should establish a collaborative dialogue with CIKR owners and 
operators in each sector to develop a commonly agreed-upon set of outcomes- 
focused goals for each sector. 

o The President should issue a Homeland Security Presidential Directive (HSPD)-level 
authority to develop a national policy on resilience in a manner similar to and 
consistent with the HSPD-7 policy for protection, but also ensure the authorities 
under this guidance and public-private infrastructure protection partnership is 
retained. (NIAC, Recommendation 1 (with selected bullet points), Critical 
Infrastructure Resilience, 2009, pp. 16-18) 

All critical infrastructure sectors should consider adopting the industry self-governance 
model exemplified by the Institute of Nuclear Power Operations and the North American 
Transmission Forum to enable the private sector to collaborate on industry-wide resilience 
and security issues outside the regulatory compliance process. (NIAC, Recommendation 4, 
Establishing Resilience Goals, 2010, p. 52) 

Ensure that the implementation of the U.S. Environmental Protection Agency's (EPA's) 
Integrated Planning & Permitting Framework fully accounts for Utility of the Future (UOTF)- 
type activities. (NACWA, Water Resources Utility of the Future: A Call for Federal Action, 
2013, p. 3) 

ADDRESSING REGULATORY POLICIES AFFECTING RECOVERY 

A process for identifying and addressing statutory, regulatory, and policy impediments to 
recovery: 

o DHS should institutionalize processes and provide funding as needed to 

systematically develop and maintain at the Federal, State, and local (especially 
major metropolitan) government levels, catalogs of specific laws and regulations 
that may need to be suspended or modified during different disaster scenarios to 
improve CIKR recovery efforts. 

o The Executive Branch should work with Congress and State legislatures to pass 
legislation with provisions that allow the executive branches in government, at the 
Federal and State levels, to grant blanket waivers for statutes and regulations 
identified as impeding recovery efforts during an emergency or disaster-type event. 
(NIAC, Recommendation 1 (with selected bullet points), Framework for Dealing with 
Disasters and Related Interdependencies, 2009, pp. 20-21) 

Potential Federal, State, and local action to address statutory, regulatory, and policy 
impediments to disaster recovery/preparedness: 

o To address the lengthy waiver process for Environmental Impact Statements (EIS), 
DHS should ask Congress to validate the "Alternative Arrangements" rule the 
Council on Environmental Quality has used to expedite EIS requirements during 
emergencies. 
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o DHS should work with the relevant Sector-Specific Agencies (SSAs) and regulators to 
identify a process for emergency waivers for document filing deadlines with 
regulatory agencies on processes that need to be expedited during a disaster. 

o DHS should ask Congress to consider legislation authorizing the waiver of Federal 
and State restrictions on the interstate movement of motor vehicles responding to a 
disaster. 

o The Federal Emergency Management Agency (FEMA) and DHS IP should collaborate 
to develop a structured, commonly applicable best practices decision-making 
process for authorities to use for credentialing CIKR workers and granting access to 
a disaster area during an emergency. (NIAC, Recommendation 2 (with selected 
bullet points), Framework for Dealing with Disasters and Related Interdependencies, 
2009, pp. 21-23) 

Determine the role of policies, regulation, and consolidation within industries and its impact 
on resilience, security, innovation, and resilience. (NIAC, Recommendation 1.3, CISR R&D 
Plan, 2014, p. 25) 

The Water Infrastructure Network (WIN) recommends Congress pass legislation and the 
President sign it, and provide funding for its provisions that: 

o Creates a long-term, sustainable, and reliable source of Federal funding for clean 
and safe water. 

o Authorizes capitalization of the next generation of State financing authorities to 
distribute funds in fiscally responsible and flexible ways, including grants, loans, loan 
subsidies, and credit assistance. 

o Focuses on critical "core" water and wastewater infrastructure needs and nonpoint 
source pollution. 

o Streamlines Federal administration of the funding program and encourages 

continuous improvement in program administration at both the Federal and State 
levels. 

o Adequately finances strong State programs to implement the Clean Water Act and 
the Safe Drinking Water Act. 

o Establishes a new program for clean and safe water technology and management 
innovation to reduce infrastructure costs, prolong the life of America's water and 
wastewater assets, and improve the productivity of utility enterprises. 

o Provides expanded, targeted technical assistance to communities most in need. 
(WIN, Water Infrastructure NOW: Recommendations for Clean and Safe Water in the 
21st Century, 2001, p. 4) 

Federal/State/local policy for emergency management must clearly elevate the Water 
Sector to top-level priority for response and recovery as recommended by the NIAC. Water 
utilities should continue to work with their critical response partners and customers to 
ensure that Water Sector response activities are coordinated, awareness exists with regard 
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to backup power and fuel needs, and coordination of credentialing and site access controls 
is done in advance. (AWWA, WARN: Superstorm Sandy After-Action Report, 2013, p. 3) 

Federal and State agencies and utilities must look more holistically at regulations to ensure 
flexibility for resilience and to leverage opportunities that capitalize on multiple benefits for 
innovation (e.g., biosolids for energy). (AMWA and NACWA, Recommendation 2.a, Water 
Resilience Summit, 2014, p. A-4) 

The President of the United States should consider issuing an Executive Order that (a) 
creates a Federal Interagency Task Force on Water Reuse to coordinate all Federal water 
reuse initiatives, and (b) sets a goal for minimum percentages of reclaimed water for all new 
Federal installations (similar to the Federal goal for recycled paper). (NACWA, Water 
Environment Research Foundation (WERF), and Water Environment Federation (WEF), The 
Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 18) 

Support a Congressional Clean Water Technology & Innovation Caucus that can bring a focus 
to UOTF priority issues. (NACWA, WERF, and WEF, Water Resources Utility of the Future: A 
Call for Federal Action, 2013, p. 3) 

Consider and explore a new 21st Century Watershed Act that can drive the Water Sector 
toward the emerging UOTF model. (NACWA, Water Resources Utility of the Future: A Call for 
Federal Action, 2013, p. 3) 

Support an Executive Order on water reuse/recycling that coordinates Federal reuse policies 
and programs, and stimulates innovation. (NACWA, Water Resources Utility of the Future: A 
Call for Federal Action, 2013, p. 3) 

Make the case for streamlined permitting requirements and flexibility in addressing 
regulatory requirements with Federal agencies, including lengthened permit terms, to allow 
for longer term resilience planning. (AMWA and NACWA, Water Resilience Summit: 
Summary & Next Steps, 2014, p. 4) 

Congress should relax the private-use test for publicly owned and operated energy recovery 
or production projects as long as the issuer first satisfies 100 percent of its own energy 
needs before selling excess production. (NACWA, WERF, and WEF, The Water Resources 
Utility of the Future: A Blueprint for Action, 2013, p. 16) 

With Congressional authorization as needed, EPA and the States should reform the Total 
Maximum Daily Load (TMDL) process to achieve reliable, least-cost loadings reductions 
regardless of source and/or other in-stream actions to restore ambient water quality goals, 
with appropriate financial support where needed, monitoring, and enforcement. (NACWA, 
WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 
13) 

EPA should amend its TMDL regulations and guidance to formally incorporate adaptive 
management as part of the TMDL approach. Until it does, EPA should issue guidance to 
State regulators that encourages States to pursue these voluntary processes based on the 
Wisconsin model. (NACWA, WERF, and WEF, The Water Resources Utility of the Future: A 
Blueprint for Action, 2013, p. 14) 
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Congress should support greater adoption of watershed-based solutions by explicitly 
encouraging trading in the Clean Water Act and extending permit terms for facilities that are 
participating in these processes. Similarly, EPA should work with delegated States to 
promote viable and flexible trading programs. (NACWA, WERF, and WEF, The Water 
Resources Utility of the Future: A Blueprint for Action, 2013, p. 13) 

Congress should consider three amendments to the Clean Water Act to acknowledge water 
recycling and reuse where it is feasible and desirable locally: 1) redefine publicly owned 
treatment works (POTW) to identify its ability to be a resource provider, 2) extend permit 
terms for projects that employ resource recovery activities such as water recycling, 3) name 
water reuse as eligible for Federal financial assistance. (NACWA, WERF, and WEF, The Water 
Resources Utility of the Future: A Blueprint for Action, 2013, pp. 17-18) 

Support statutory changes to the Clean Water Act and Safe Drinking Water Act that bolster 
the important role recycled water can play in public health and safety. (NACWA, Water 
Resources Utility of the Future: A Call for Federal Action, 2013, p. 3) 

EPA should revise the March 2011 sewage sludge incineration rule to exclude sewage sludge 
incinerators that use biosolids to generate energy. More broadly, EPA should work with 
clean water authorities to formulate procedures that account for multimedia assessment of 
energy and resource recovery alternatives at their facilities, so that future rules can take a 
broader, more holistic perspective of all environmental benefits and risks. (NACWA, WERF, 
and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 15) 

Using materials that they have already developed, EPA should support local stormwater 
management entities in initiatives designed to educate the public about the value of, and 
equitable ways to pay for, stormwater management as one component of integrated 
management plans for all water resources within local watersheds. (NACWA, WERF, and 
WEF, The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 19) 

Consistent with the findings of the National Academy in its recent study on water reuse, 
Congress should amend the Safe Drinking Water Act to make explicit certain safeguards 
(e.g., advanced treatment, increased monitoring) that are needed to assure that potable 
reuse can indeed be safe. (NACWA, WERF, and WEF, The Water Resources Utility of the 
Future: A Blueprint for Action, 2013, p. 17) 

An appropriate organization of the 50 States such as the Council of State Governments 
should formulate a program of reciprocal technology certification, where once tested and 
permitted in one State, the burden of proof to deny a permit for that technology in any 
other State falls to the regulatory agency based on guidelines agreed by all 50 States. 
(NACWA, WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 
2013, p. 25) 

State legislatures should amend their Renewable Portfolio Standard (RPS) eligibilities to 
include energy recovery projects from biosolids. To help legislatures understand why such 
changes would generate triple bottom-line benefits, the wastewater industry should 
educate State legislatures on this matter. (NACWA, WERF, and WEF, The Water Resources 
Utility of the Future: A Blueprint for Action, 2013, p. 16) 
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States should clarify use rights associated with, and rules governing groundwater storage of, 
reclaimed wastewater so that private developers and public agencies would have stronger 
incentives to engage in nonpotable reuse of wastewater. (NACWA, WERF, and WEF, The 
Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 17) 

States in which additional water reuse would help meet future demand for water supplies 
safely and at least cost should amend State Revolving Fund (SRF) eligibilities to include 
wastewater reuse. (NACWA, WERF, and WEF, The Water Resources Utility of the Future: A 
Blueprint for Action, 2013, p. 17) 

FOCUSING ON REGIONAL NEEDS 

The President should require that Federal agencies: a) explicitly consider and address the 
differences among regions when promulgating security and resilience rules, programs, or 
guidance; and b) expressly state how they have customized implementation to each region 
if there is not generic applicability. (NIAC, Recommendation 3.3, Regional Resilience, 2013, 

p. 6) 

The President should designate the Energy, Communications, Water and Wastewater 
Systems, and Transportation Systems Sectors as lifeline sectors and direct SSAs to examine 
their policies, procedures, and programs to determine the extent to which they recognize 
the priority of the lifeline sectors and the individuality of regions, amending or revising 
those that do not. (NIAC, Recommendation 3, Regional Resilience, 2013, p. 6) 

The Secretary of Flomeland Security should initiate a pilot program with State and local 
governments in select regions to conduct regional joint exercises, develop risk maps of 
critical sector interdependencies, and extract lessons learned on regional needs and gaps for 
government and sector partners. (NIAC, Recommendation 2.2, Regional Resilience, 2013, p. 
5) 

There is a need for better information regarding the scope and magnitude of forecasted 
disasters impacting potable water: 

o It would be beneficial to promote State-wide and regional exercises that specifically 
consider water outages. 

o Multiagency emergency water supply plans should include an assessment as to 
recovery periods being extended due to critical spare parts not being available for 
long durations and the time periods for restoring critical infrastructure to functional 
condition. (EPA, Planning for an Emergency Drinking Water Supply, 2011, p. 31) 

Regional governments should consider creating joint water/wastewater/stormwater utilities 
that can manage all water within their jurisdictional boundaries as a single resource. 

Further, these unified water management enterprises would be better equipped to 
coordinate more effectively with land-use, transport, housing, energy, and other local 
authorities that use or affect water. (NACWA, WERF, and WEF, The Water Resources Utility 
of the Future: A Blueprint for Action, 2013, p. 20) 
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State and local emergency operations centers must establish clearly defined roles and 
responsibilities for Water Sector support. Representation can be physical or virtual, but 
should include a member from WARN. (AWWA, WARN: Superstorm Sandy After-Action 
Report, 2013, p. 3) 

FACILITATING INFRASTRUCTURE INVESTMENTS AND 
INCENTIVES 

Explore the potential for creating tax incentives or other instruments to incentivize the 
private sector to enhance the resilience of critical infrastructure. (NIAC, Recommendation 8, 
Cross Sector Interdependencies, 2004, p. 11) 

To help fill the relative cost gap and generate other economic and environmental benefits of 
wastewater reuse, the wastewater industry should advocate for wastewater reuse 
investment tax credits to attract private investment, expanded grants to cover costs of 
facility feasibility studies, and/or loan guarantees for reuse projects that serve rural or low- 
income communities that could not afford to repay market rates. (NACWA, WERF, and WEF, 
The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 26) 

Develop, clarify, and expand tax credit and incentive programs that will encourage clean 
water agencies and their private sector partners to engage in UOTF-related activities, 
especially in energy conservation and production, water reuse, resource recovery, and green 
infrastructure. (NACWA, Water Resources Utility of the Future: A Call for Federal Action, 
2013, p. 3) 

The President should direct the Council of Economic Advisors and the Office of Science and 
Technology Policy to work with Federal agencies to create a strong and enduring value 
proposition for investment in resilient lifeline infrastructure—and its underlying physical and 
cyber systems, functions, and assets—and accelerate the adoption of innovative 
technologies in major infrastructure projects. (NIAC, Recommendation 6, Regional 
Resilience, 2013, p. 7) 

Within one year, U.S. Department of Energy (DOE), in conjunction with the Council of 
Economic Advisors and the White House Office of Science and Technology Policy, should 
complete a pilot analysis of the value proposition for investment in infrastructure grid 
modernization and recommend any incentives or alternative mechanisms for cost recovery 
that may be needed to encourage long-term investment in the modernization of lifeline 
infrastructure. Using the Energy Sector as the vanguard, all lifeline-sector SSAs should work 
with their sector partners to establish the value proposition for investment and financing in 
other critical sectors. (NIAC, Recommendation 6.1, Regional Resilience, 2013, p. 8) 

DHS should work through Federal research organizations, academic institutions, and the 
national laboratories to develop Applied Centers of Excellence for Infrastructure Resilience 
to provide an operating environment to test and validate innovative technologies and 
processes that build resilience into new large-scale infrastructure projects, integrate next- 
generation R&D, and share results with other designers in other regions. By partnering with 
lifeline sector owners and operators, these centers will leverage opportunities for real-world 
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testing, raise awareness of new capabilities, and speed commercialization of emerging 
technologies. (NIAC, Recommendation 6.3, Regional Resilience, 2013, p. 8) 

• Encourage resilience using appropriate market incentives: 

o Government should partner with CIKR owners and operators to leverage their 
understanding of market forces, incentives, and disincentives in order to apply 
appropriate action that will strengthen infrastructure resilience. (NIAC, 
Recommendation 5 (with selected bullet point), Critical Infrastructure Resilience, 
2009, pp. 26-27) 

Research and analyze the labyrinth of regulations and policies across all levels of 
government that impede and dis-incent investments in security and resilience. (NIAC, 
Recommendation 1.1, CISR R&D Plan, 2014, p. 24) 

Identify essential elements of enabling policies and regulations that would encourage and 
facilitate owner and operator investment and gain public acceptance of such investments, 
particularly for many of the lifeline sectors, for which rates and return on investment are 
determined through State and Federal commissions. (NIAC, Recommendation 1.2, CISR R&D 
Plan, 2014, p. 25) 

Identify and establish the elements for business and public justification for investments 
from lessons learned. (NIAC, Recommendation 2.1, CISR R&D Plan, 2014, p. 25) 

Develop an effective model of shared industry funding. (NIAC, Recommendation 2.2, CISR 
R&D Plan, 2014, p. 26) 

Create a program for early stage technology and innovation investment for the Water Sector 
similar to programs that exist in the energy sector. (NACWA, Water Resources Utility of the 
Future: A Call for Federal Action, 2013, p. 3) 

Advocate leveraging existing Federal funds from agencies with programs that benefit 
drinking water and clean water utilities for projects that advance resilience goals (e.g., SRFs, 
Water Infrastructure Finance and Innovation Act (WIFIA), Farm Bill, U.S. Department of 
Energy (DOE) grants and U.S. Department of Flousing and Urban Development (HUD) 
Community Block Grants). (AM WA and NACWA, Water Resilience Summit: Summary & Next 
Steps, 2014, p. 4) 

Congress should establish and fund Advanced Research Projects Agency (ARPA)-W to work 
with industry to define high-risk, high-reward R&D needs, solicit proposals from public and 
private enterprises that had solutions at various stages of commercialization, and manage 
information flow about the research for the benefit of the industry and the Nation. 

(NACWA, WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 
2013, p. 23) 

Congress should establish within ARPA-W, a special development facility for consortia of 
clean water agencies, universities/research centers, and technology developers, who 
together would jointly apply for federally subsidized private insurance that would offset 
utility costs in the event that piloting innovative technologies was unsuccessful. This facility 
also could provide tax credits to private corporations that partnered with a grant recipient 
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to help offset risks associated with developing and commercializing its technology. (NACWA, 
WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 
24) 

Clean water agencies should take advantage of any unobligated grant funds and to the 
extent they are eligible, loans from the 29 States that established revolving loan funds using 
State Energy Program (SEP) grants. On the basis of strong performance of the 2009 
American Recovery and Reinvestment Act (ARRA) funding, the wastewater community 
should advocate for continued funding under these programs, with explicit 
acknowledgement that clean water agencies should be priority recipients of funding 
assistance. (NACWA, WERF, and WEF, The Water Resources Utility of the Future: A Blueprint 
for Action, 2013, pp. 21-22) 

The Bureau of Reclamation should focus Federal grants on reuse projects, without which 
returns would be insufficient to attract private co-investment and where they deliver high 
net economic and social benefits. (NACWA, WERF, and WEF, The Water Resources Utility of 
the Future: A Blueprint for Action, 2013, p. 21) 

Refocus existing Federal grant programs to support UOTF initiatives. (NACWA, Water 
Resources Utility of the Future: A Call for Federal Action, 2013, p. 3) 

• The wastewater community should advocate for a continuation, if not an expansion of these 
EPA programs. Continued Federal funding not only preserves the intergovernmental 
partnership embedded within the Clean Water Act, it creates jobs and accounts for the 
"public goods" benefits that all clean water utilities deliver when they ship cleaner water to 
downstream users; reduce greenhouse gas emissions through energy efficiency, methane 
reduction, and renewable energy production; and reduce runoff from green infrastructure. 
(NACWA, WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 
2013, p. 22) 

The U.S. Department of Agriculture (USDA) should take steps to assure that a greater 
proportion of their conservation program assistance funds nutrient reduction programs. 
(NACWA, WERF, and WEF, The Water Resources Utility of the Future: A Blueprint for Action, 
2013, p. 23) 

• Create and support market-based approaches to efficiently and more equitably address 
watershed-scale water quality challenges. (NACWA, Water Resources Utility of the Future: A 
Call for Federal Action, 2013, p. 3) 

The Water Sector should work with Congress to examine these programs to assure that they 
do not exclude or limit their participation and where it does or can, they should work with 
Congress to amend authorizing language to ensure that private investors have every 
incentive to partner with clean water authorities to extract energy from wastewater and 
biosolids, and to ensure that renewable energy from these facilities however generated is 
eligible to participate in markets for renewable energy. (NACWA, WERF, and WEF, The 
Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 15) 

There are multiple ways to prevent these negative consequences described in this report. 
Possible preventive measures include spending more on existing technologies, investing to 
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develop and then implement new technologies, and changing patterns in where and how 
we live. All these solutions involve costs. Separately or in combination, these solutions will 
require action at the national, regional, and private levels, and will not occur automatically. 
(American Society of Civil Engineers (ASCE), Failure to Act: The Economic Impact of Current 
Investment Trends in Water and Wastewater Treatment Infrastructure, 2011, p. 42) 

III. COMPLEMENTARY PUBLIC AND PRIVATE 
RESILIENCE BUILDING 


Achieving critical infrastructure security and resilience requires close collaboration between the 
public and private sectors. Sectors cannot singularly understand, prepare for, or manage the 
complexities inherent in securing and making the Nation's interdependent and complex 
infrastructure more resilient. The recommendations in this category include practical ways to 
address the need for resilience on a massive scale, and are organized into two focus areas: 
improving public-private partnerships and fostering senior executive-level engagement. 

IMPROVING PUBLIC-PRIVATE PARTNERSHIPS 

• Clarify roles and responsibilities of critical infrastructure partners: 

o Review current incident management documents including the National Response 
Framework (NRF) and the National Incident Management System (NIMS) and 
identify opportunities to expand training and outreach activities to CIKR owners and 
operators. Such activities provide Federal, State, and local entities a better 
understanding of the components of resilience during an event and allow for 
increased information sharing. 

o CIKR owners and operators and DFHS should identify a mechanism to monitor and 
measure resilience at the CIKR sector level. This process should include 
establishment and support of a feedback mechanism to address CIKR owner and 
operator concerns in all critical infrastructure sectors and should specifically assess 
the adequacy of the supply chain to meet response and recovery needs. This 
process should be analogous to and in coordination with the National Infrastructure 
Protection Plan annual reporting process. 

o Government should develop a better understanding of the role that repair and 
maintenance funding can have on CIKR and prioritize funding for these activities, 
both as a component of its resilience activities and part of its broader funding 
support of public infrastructure. (NIAC, Recommendation 3 (with selected bullet 
points), Critical Infrastructure Resilience, 2009, pp. 19-21) 

• Strengthen and leverage public-private partnership: 

o Government should collaborate with CIKR executive decision-makers throughout 
the resilience policy development process. Development must be an iterative 
process featuring bidirectional communication and a clear understanding of how to 
reach consensus. 
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o Government should use the existing Sector Partnership Model to plan and 
implement resilience efforts in coordination with, and addition to, current 
protection activities. 

o DHS should implement the NIAC's recommendations contained within the 

Framework for Dealing with Disasters and Related Interdependencies that support 
needed changes for CIKR operator regulatory relief during a national crisis or 
incident, CIKR worker credentialing and access to a disaster area, and clarification of 
disaster recovery priorities and roles. This improved coordination among CIKR 
sectors and government will provide faster recovery times and more focus on 
restoring operations, order, and public safety. 

o Government should endeavor to better understand the role of design and 

construction in infrastructure resilience. Application of this understanding will help 
to shape the policy, R&D funding, and incentives that can spur technological 
innovation as well as the robust design and construction of critical infrastructure 
needed for resilience. (NIAC, Recommendation 4 (with selected bullet points), 
Critical Infrastructure Resilience, 2009, pp. 21-26) 

Increase flexibility in the sector partnership to better accommodate diverse sector needs: 

o DHS should encourage Sector Coordinating Councils (SCCs) to develop strategic 
roadmaps to enable sectors to articulate a variety of sector needs, identify sector 
priorities, and implement protection and resilience strategies. (NIAC, 
Recommendation 5 (with selected bullet point), Cl Partnership Strategic 
Assessment, 2008, pp. 10-11) 

The Secretary of Homeland Security should facilitate efforts with governors, mayors, and 
local government officials to identify or develop regional, public-private, cross-sector 
partnerships, led by senior executives, to coordinate lifeline sector resilience efforts within a 
given region. (NIAC, Recommendation 2, Regional Resilience, 2013, p. 5) 

DHS IP should lead a national effort to improve the understanding of resilient activities and 
how they are implemented in support of combined infrastructure and community resilience. 
(NIAC, Recommendation 1, Optimization of Resources, 2010, p. 19) 

• Federal agencies and utilities should work together to better inform the public and 
communities about the need for resilience in water systems. (AMWA and NACWA, 
Recommendation 3.a, Water Resilience Summit, 2014, p. A-4) 

Working more closely with the design engineering community to understand new stochastic 
approaches to performance and design of advanced technologies including biological 
nutrient reduction (BNR), State, and Federal permit writers need to incorporate results into 
new permits to assure that they have more realistic parameter limits that are still protective 
of the environment, but achievable at more appropriate costs. (NACWA, WERF, and WEF, 
The Water Resources Utility of the Future: A Blueprint for Action, 2013, p. 25) 
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Increase participation in Water/Wastewater Agency Response Network (WARN) and 
representation in local and State emergency operation centers (EOCs). (AWWA, WARN: 
Superstorm Sandy After-Action Report, 2013, p. 2) 

Develop consistent damage assessment and system status criteria for use at the local, State, 
and Federal level in partnership with WARNs. Information requests from response partners 
for systems status should be connected with utility requests for resources to restore 
operations to support situational awareness and coordination of resources needed to repair 
the systems. (AWWA, WARN: Superstorm Sandy After-Action Report, 2013, p. 4) 

Increase awareness of Emergency Management Assistance Compact's (EMAC's) applicability 
in supporting Water Sector needs. (AWWA, WARN: Superstorm Sandy After-Action Report, 
2013, p. 2) 

Water Sector requests for generator and fuel support must be shared with the WARN and 
the Emergency Support Function 3 - Public Works (ESF 3) desk in the EOC. In addition, the 
DOE must make restoration of power to Water Sector assets a top priority for all power 
distribution providers. Utilities should continue to assess their energy management 
strategies to continue normal operations after a power failure. A diverse set of strategies 
exists for utilities that should be customized for their specific conditions. (AWWA, WARN: 
Superstorm Sandy After-Action Report, 2013, p. 3) 

FOSTERING SENIOR EXECUTIVE-LEVEL PARTNERSHIPS 

The President should direct the heads of the appropriate SSAs to form partnerships with 
senior executives from lifeline sectors, using a process modeled after the government's 
successful executive engagement with the Electricity subsector. (NIAC, Recommendation 1, 
Regional Resilience, 2013, p. 4) 

Within six months, the President should direct the heads of appropriate SSAs to convene a 
meeting with chief executive officers (CEOs) or other owner/operator leadership with 
equivalent decision-making authority from each lifeline sector to explore the formation of a 
partnership to address high-priority risks to the sector's infrastructure. (NIAC, 
Recommendation 1.1, Regional Resilience, 2013, p. 5) 

Incorporation of CEO-relevant roundtables to sector-specific or national exercises which will 
assist them to identify decisions or issues that their companies, and a sector as a whole, will 
need to manage from a financial, regulatory, operational, and reputational corporate risk 
level. (NIAC, Recommendation 8.4, CEO Engagement, 2015, p.30) 

IV. EMERGENCY PLANNING AND RESPONSE 


When a disaster occurs, effective emergency planning and response can mean the difference 
between life and catastrophic loss. While the NIAC framework for resilience, developed in the 
NIAC's 2010 study on establishing resilience goals, emphasizes a spectrum of activities—including 
planning, preparation, recovery and adaptability—the Council has frequently developed 
recommendations focused specifically on improving emergency planning exercises and operations 
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to support Federal, State, local, and private sector efforts. Recommendations in this category are 
organized into five focus areas: 

• Conducting cross-sector exercises 

• Enhancing simulation and analysis tools 

• Facilitating regional resilience planning 

• Incorporating lifeline sectors in EOCs 

• Developing access-credentialing solutions 

CONDUCTING CROSS-SECTOR EMERGENCY PLANNING 
EXERCISES 

The Secretary of Homeland Security should facilitate efforts with governors, mayors, and 
local government officials to identify or develop regional, public-private, cross-sector 
partnerships, led by senior executives, to coordinate lifeline sector resilience efforts within a 
given region. 

o DHS should initiate a pilot program with State and local governments in select 
regions to conduct regional joint exercises, develop risk maps of critical sector 
interdependencies, and extract lessons learned on regional needs and gaps for 
government and sector partners. Each regional partnership should conduct a 
regional cross-sector exercise, with full participation by public and private sector 
partners at the executive and operational level, to simulate a catastrophic event 
across a large geographic region. The exercise should be led by the regional partners 
and supported by DHS experts, processes, and tools as needed. Such an exercise will 
allow participants to "experience" unprecedented events, identify coordination and 
communication challenges, and help expose hidden physical and cyber risks due to 
lifeline sector interdependencies. The results of the exercise should be used to 
create an action plan to address needs and gaps. (NIAC, Recommendation 2 (with 
selected bullet point), Strengthening Regional Resilience, 2013, p. 43) 

DHS IP should lead a continuing effort to enhance the transfer of expertise and lessons 
learned from national-level infrastructure planning and analysis to regional and community- 
level systems. 

o DHS IP should sponsor a series of regional exercises devoted specifically to the issue 
of the distribution of goods and services during a major event affecting community 
resilience. The purpose of these exercises is to bring together officials at all levels of 
government and private sector owners and operators to identify the specific 
resources that may be needed in such an event, where the resources may be 
available, and how they are to be distributed under emergency conditions. The 
results of these exercises should be compiled into a report and widely distributed as 
part of FEMA's community outreach program to aid in community resilience 
planning. (NIAC, Recommendation 4, Optimization of Resources for Mitigating 
Infrastructure Disruptions, 2010, p. 21-22) 
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Implement government enabling activities and programs in concert with critical 
infrastructure owners and operators: 




o Engage CIKR owners and operators to conduct more cross-sector emergency 
planning exercises to identify interdependencies, improve preparedness, and 
establish relationships between sectors, local government, State government, and 
the Federal Government. Results of these exercises should be accessible to all 
related sectors and facets of government, regardless of whether or not they 
participated in the exercise, so that the full benefits of resilience and business 
continuity planning can be realized. (NIAC, Recommendation 6 (with selected bullet 
point), Critical Infrastructure Resilience, 2009, p. 27) 

ENHANCING CRITICAL INFRASTRUCTURE SIMULATION AND 
ANALYSIS 

• Develop and integrate modeling and simulation tools. 

o Develop, scale and integrate interdependency and consequence modeling, and 
simulations to support operational decisions to predict and prevent cascading 
failures. Research and development should be performed to develop a 
comprehensive and functional simulated environment that can be used to analyze 
the effects of infrastructure failure in the wake of a disaster. This environment will 
allow users to see how clear and present threat scenarios would affect 
infrastructure, and how the disruption of those essential services would affect other 
vital services. Such a tool would be utilized by communities and institutions and 
government at all levels for planning, coordination, and focused investments to act 
on lessons learned and improve preparedness. (NIAC, Recommendation 4 (with 
selected bullet point), CISR R&D Plan, 2014, p. 29-30) 

DHS IP should expand the provision of scalable, low-cost tools and techniques for 
community-level identification and assessment of infrastructure interdependencies. Many 
effective tools and techniques are widely used on a national level to assess 
interdependencies and their potential impacts. Further development and transfer of 
infrastructure-based tools could demonstrably increase the ability of communities to 
establish and maintain an improved understanding of infrastructure assets and the 
associated community and infrastructure interdependencies. In turn, understanding of 
these interdependencies can improve the planning and use of resources in the event of 
disruptions. (NIAC, Recommendation 3, Optimization of Resources for Mitigating 
Infrastructure Disruptions, 2010, p. 21) 

DHS should support modeling and analysis studies of the cross-sector economic impacts of 
CIKR failures using tools such as input-output analysis. Many of the CIKR sectors are highly 
interconnected, which can improve resilience but also create new opportunities for 
problems to cascade across sectors, regions, and economic systems. Understanding the 
impact of sector failures is becoming more important as infrastructures become increasingly 
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interconnected. (NIAC, Recommendation 6, A Framework for Establishing Critical 
Infrastructure Resilience Goals, 2010, p. 52-53) 

FACILITATING REGIONAL RESILIENCE PLANNING 

DHS IP should lead a national effort to improve the understanding of resilient activities and 
how they are implemented in support of combined infrastructure and community resilience. 

o DHS IP collaborating with FEMA should encourage regional organizations to develop 
Regional Infrastructure Protection Plans (RIPP) to support the coordination of 
regional all-hazards planning for catastrophic events. Regional plans should include 
the development of integrated protocols and procedures to manage a catastrophic 
event. An important component of regional plans should be the linkage of response 
operations and available resources. The NIAC encourages regional organizations to 
seek funding for RIPPs through the DHS Regional Catastrophic Preparedness Grant 
Program. (NIAC, Recommendation 1 (with selected bullet point), Optimization of 
Resources for Mitigating Infrastructure Disruptions, 2010, p. 19) 

INCORPORATING LIFELINE SECTORS IN EMERGENCY 
OPERATIONS CENTERS 

The President should designate the Energy, Communications, Water, and Transportation 
Sectors as lifeline sectors, and direct SSAs to examine their policies, procedures, and 
programs to determine to what extent they recognize the priority of the lifeline sectors and 
the individuality of regions, amending or revising those that do not. 

o The FEMA National Response Coordination Center, Federal agencies, and State and 
local governments should modify their processes and plans for emergency 
operations to include the co-location of representatives of lifeline sectors in their 
EOCs during major disasters. The practice of including operational personnel from 
energy, communications, and other lifeline sectors in EOCs during Superstorm 
Sandy improved situational awareness, streamlined communications, and expedited 
response and recovery. (NIAC, Recommendation 3 (with selected bullet point), 
Strengthening Regional Resilience, 2013, p. 44) 

DEVELOPING ACCESS-CREDENTIALING SOLUTIONS 

The Secretary of Homeland Security, working with heads of appropriate Federal agencies, 
should launch a cross-agency team within 60 days to develop solutions to site access, 
waiver, and permit barriers during disaster response and begin implementing solutions 
within one year. (NIAC, Recommendation 5, Regional Resilience, 2013, p. 7) 

DHS IP and FEMA should collaborate with State, local, tribal, and territorial governments 
and owners and operators to develop a commonly applied process or system to credential 
lifeline sector owners and operators and grant them access to disaster areas more 
effectively. (NIAC, Recommendation 5.1, Regional Resilience, 2013, p. 7) 
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DHS should work with State and local government and infrastructure owners and operators 
to catalog the waivers and permits commonly required during a variety of disaster scenarios 
and develop a streamlined process for rapidly issuing those permits and waivers at the 
Federal, State, and local level. (NIAC, Recommendation 5.2, Regional Resilience, 2013, p. 7) 

The Water Sector should continue to work with Federal, State, and local response partners 
to ensure water utility crews are properly recognized and allowed access to their facilities. 
(AWWA, WARN: Superstorm Sandy After-Action Report, 2013, p. 3) 

V. INFORMATION SHARING 


Information sharing is an essential role of public-private partnerships across the entire spectrum of 
preparedness. Without sufficient information sharing, collaboration between various levels of 
government and critical infrastructure owners and operators would not work. Given the complexity 
of this issue, the NIAC and other organizations have spent considerable time assessing the various 
means and effectiveness of public-private information sharing. The recommendations in this 
category address information-sharing needs in two focus areas: 

• Improving intelligence information sharing 

• Understanding infrastructure intelligence needs 

IMPROVING INTELLIGENCE INFORMATION SHARING 

• Direct that DHS and the Office of the Director of National Intelligence (ODNI), in 
collaboration with other members of the U.S. Intelligence Community and the SSAs, prepare 
a quadrennial report on the state of intelligence information sharing for infrastructure 
protection and resilience. (NIAC, Recommendation 4.1.c, Intelligence Information Sharing, 
2012, p. 44) 

DHS, with the guidance and aid of ODNI, should establish core teams of 3-4 intelligence 
specialists for each sector, as well as a team that focuses on cross-sector information issues. 
These specialists should 1) be drawn from the members of the Federal Intelligence 
Community, 2) have expertise in both intelligence processes and sector business and risk- 
management processes, and 3) be responsible for fusing varied intelligence information 
streams into products useful for owner and operator planning and decision-making. (NIAC, 
Recommendation 4.2.c, Intelligence Information Sharing, 2012, p. 46) 

• Senior executive information-sharing mechanism: Develop a voluntary executive-level 
information-sharing mechanism between critical infrastructure CEOs and senior intelligence 
officers. (NIAC, Recommendation 1, Public-Private Sector Intelligence Coordination, 2006, p. 
22 ) 

The Federal Government should ensure the availability of qualified, vetted security 
professionals. (NIAC, Recommendation 4, Implementation of EO13636 and PPD-21, 2013, p. 
18) 
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UNDERSTANDING INFRASTRUCTURE INTELLIGENCE NEEDS 


Direct the Federal Intelligence Community to consider infrastructure protection and 
resilience as a national priority; collect infrastructure intelligence needs; and prepare a 
National Intelligence Estimate to evaluate terrorist targets in the 18 critical infrastructure 
sectors and assess vulnerability to such attacks, including cross-sector interdependencies 
and risks. (NIAC, Recommendation 4.1.b, Intelligence Information Sharing, 2012, p. 44) 

The NIAC recommends that DHS work with each SSA to implement, for all 18 critical 
infrastructure sectors, a robust intelligence requirements process that 1) meets the 
information needs of owners and operators, 2) delivers these requirements to appropriate 
elements of the Intelligence Community, 3) is consistent with existing Intelligence 
Community processes, and 4) supports advocacy for critical infrastructure priority within the 
Intelligence Community. (NIAC, Recommendation 4.3, Intelligence Information Sharing, 
2012, pp. 46-47) 

Within key intelligence agencies throughout the Intelligence Community, create "sector 
specialist" positions at both the executive and operational levels, as applicable. (NIAC, 
Recommendation 5, Public-Private Sector Intelligence Coordination, 2006, p. 25) 

VI. CYBERSECURITY 


Managing cyber risks to operations has become an increasing component of water utilities' security 
and resilience portfolios. The Federal Government's role in aiding utilities is broad, and includes 
increasing awareness and planning, developing secure control system standards, incentivizing 
technology development and investments, examining and sharing information about cyber risks and 
vulnerabilities, and pursuing cyber criminals. The recommendations in this category address these 
roles. 

Use the Federal Government's procurement power to encourage information technology 
suppliers to develop cybersecurity framework-compliant hardware and software. (NIAC, 
Recommendation 3, Implementation of EO 13636 and PPD-21, 2013, p. 17) 

The Federal Government should leverage its purchasing power to incentivize enhanced 
security and resilience in core cybersecurity systems and programs (e.g., Information 
Technology, Industrial Automation, and Telecommunications Sectors). (NIAC, 
Recommendation 7.2, Implementation of EO 13636 and PPD-21, 2013, p. 19) 

The Federal Government should develop policies and apply resources to pursue and 
discourage global cyber criminals from attacking critical infrastructure facilities. (NIAC, 
Recommendation 7.4, Implementation of EO 13636 and PPD-21, 2013, p. 19) 

• Recommendations for security as an enabler: 

o The President should establish a goal for all critical infrastructure sectors that no 
later than 2015, control systems for critical applications will be designed, installed, 
operated, and maintained to survive an intentional cyber assault with no loss of 
critical function. 
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o DHS should promote uniform acceptance across all sectors that investment in 
control systems cybersecurity is a priority. For sectors with regulatory oversight of 
earnings and investments, DHS should promote inclusion of the costs of control 
systems cybersecurity as legitimate investments and expenses that deserve 
approval by their regulatory bodies. (NIAC, Recommendations for Security as an 
Enabler (with selected bullet points), Convergence of Physical and Cyber Security, 
2007, p. 18) 

• Recommendation for market drivers: 

o DHS and the SSAs should encourage the application of existing security and security¬ 
relevant standards and criteria in the development and implementation of secure 
control systems. (NIAC, Recommendations for Market Drivers (with selected bullet 
point), Convergence of Physical and Cyber Security, 2007, p. 20) 

• Recommendation for executive leadership awareness: 

o To improve executive leadership awareness of the cyber risk to control systems, the 
NIAC recommends that DHS work with SSAs to implement a program for control 
systems cybersecurity executive awareness outreach. (NIAC, Recommendations for 
Executive Leadership Awareness (with selected bullet point), Convergence of 
Physical and Cyber Security, 2007, p. 22) 

• Recommendation for information sharing: 

o DHS should enhance existing program activities to create the ability to integrate and 
track understanding of the cyber risk for critical infrastructure control systems using 
all available sources. 

■ This collaborative program should collect, correlate, integrate, and track 
information on the following: 

• Threats, including adversaries, toolsets, motivations, 
methods/mechanisms, incidents/actions, and resources. 

• Consequences, including potential consequences of compromise to 
sector, industry, and facility-specific control systems. 

• Vulnerabilities in control systems or their implementations in the 
information technology infrastructure that adversaries could exploit 
to gain access to critical infrastructure control systems. 

■ This capability is a DHS operations function, and it will include input and 
expertise from the following: critical infrastructure owners and operators 
and other relevant parties in the private sector regarding consequences and 
vulnerabilities, the Intelligence Community regarding threats, Carnegie 
Mellon's Computer Emergency Response Team Coordination Center and 
other sources regarding incidents, and DHS (including the United States 
Computer Emergency Readiness Team) regarding cyber vulnerabilities. 
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■ DHS will communicate resulting warning information to control systems 
owners and operators to ensure protection of U.S. critical infrastructure. 
(NIAC, Recommendation 6, Convergence of Physical and Cyber Security, 

2007, p. 27) 

Direct lead agencies to work with each of the critical sectors to more closely examine the 
risks and vulnerabilities of providing critical services over network-based systems. (NIAC, 
Recommendation 1, Prioritizing Cyber Vulnerabilities, 2004, p. 10) 

Direct DHS to sponsor cross-sector activities to promote a better understanding of the cross¬ 
sector vulnerability impacts of a cyberattack. (NIAC, Recommendation 4, Prioritizing Cyber 
Vulnerabilities, 2004, p. 10) 

Direct Federal agencies to include cyberattack scenarios and protective measures in their 
disaster recovery planning. Encourage sector coordinating groups to include cyberattack 
scenarios and protective measures in their disaster recovery planning. (NIAC, 
Recommendation 5, Prioritizing Cyber Vulnerabilities, 2004, p. 11) 

Security should be designed to be built in to systems, rather than layered on top of systems. 
(NIAC, Recommendation 7.1, Implementation of EO 13636 and PPD-21, 2013, p. 19) 

Develop real-time cybersecurity risk-analysis and management tools. (NIAC, 
Recommendation 3.1, CISR R&D Plan, 2014, p. 27) 

Establish new architectures to "bake in" self-healing and self-protected cyber systems. 

(NIAC, Recommendation 3.2, CISR R&D Plan, 2014, p. 27) 

Develop automated security analysis and data collection tools and methods. (NIAC, 
Recommendation 3.3, CISR R&D Plan, 2014, p. 28) 

Understand cross-sector connections that could cause cascading effects. (NIAC, 
Recommendation 3.4, CISR R&D Plan, 2014, p. 28) 

Measure the effectiveness of security. (NIAC, Recommendation 3.5, CISR R&D Plan, 2014, p. 
28) 


VII. CAPABILITIES TO ADDRESS EMERGING ISSUES 


Resilience occurs in a dynamic environment. The Nation enhances resilience through a continual 
process of implementation, review, and improvement. Recommendations in this category highlight 
evolving capabilities and tools to address emerging issues related to resilience, organized into three 
focus areas: 

• Examining social-media capabilities 

• Developing simulation and modeling tools 

• Developing design standards and best practices 
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EXAMINING SOCIAL-MEDIA CAPABILITIES 

FEMA and the Federal Communications Commission (FCC) should convene a task force of 
senior emergency managers from lifeline sector SSAs and representatives of leading private 
sector social media and technology firms—such as Twitter, Facebook, and Google—to 
examine how new and emerging social media apps, platforms, and capabilities can be used 
to support emergency notification and response and provide greater value to the public. The 
task force should publish its findings in a report on best practices. (NIAC, Recommendation 
4.1, Regional Resilience, 2013, p. 6) 

DEVELOPING SIMULATION AND MODELING TOOLS 

Scale risk assessment and, management decision support tools for local communities and 
individual institutions. (NIAC, Recommendation 4.1, CISR R&D Plan, 2014, p. 28) 

Develop, scale and integrate interdependency and consequence modeling, and simulations 
to support operational decisions to predict and prevent cascading failures. (NIAC, 
Recommendation 4.2, CISR R&D Plan, 2014, pp. 28-29) 

Continue research and development for managing "big data." (NIAC, Recommendation 4.3, 
CISR R&D Plan, 2014, p. 29) 

DEVELOPING DESIGN STANDARDS AND BEST PRACTICES 

Determine design standards and best practices for the replacement, upgrading, and 
maintenance of critical infrastructure systems. (NIAC, Recommendation 2.3, CISR R&D Plan, 
2014, p. 26) 

Identify innovative, cost-efficient, and accelerated approaches to "People Readiness" in 
developing a skilled workforce. (NIAC, Recommendation 2.4, CISR R&D Plan, 2014, p. 26) 

Determine factors and approaches to accelerate recovery following a disaster. (NIAC, 
Recommendation 2.5, CISR R&D Plan, 2014, pp. 26-27) 

Establish resilience metrics. (NIAC, Recommendation 2.6, CISR R&D Plan, 2014, p. 2) 
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APPENDIX F. 

FEDERAL POLICIES, AGENCIES, AND ACTIVITIES 

This appendix outlines the Federal agencies interacting with the Water Sector and describes Federal 
policy and actions that address Water Sector resilience. First, it identifies Federal policies related to 
water and wastewater system resilience, examining examples of Federal law, presidential 
directives and executive orders and other guidance. Second, it outlines the primary Federal 
agencies involved in the Water Sector. Third, it describes Federal programs and activities related to 
resilience in the Water Sector. Lastly, it provides an overview of the components of Federal funding. 

I. FEDERAL POLICIES 


A number of laws, statutes, directives, and guidance inform Federal policies related to Water Sector 
resilience. Federal policies then inform the initiatives, programs, projects, and activities designed to 
strengthen protection and resilience within the sector's infrastructure. There are two primary laws 
governing Water Sector systems and enforcement to protect human health and the environment: 
Safe Drinking Water Act and Clean Water Act. 68 Presidential directives and executive orders—such 
as PPD-21 Critical Infrastructure Security and Resilience—build on the pursuit of critical 
infrastructure security and resilience. In addition, Federal guidance and major funding mechanisms 
further support Water Sector resilience initiatives, programs, projects, and activities carried out by 
Federal agencies. 

FEDERAL LAWS 

There are four Federal laws that most impact water resilience. Two focus on water resilience and 
two address emergency response. 

Safe Drinking Water Act (SDWA) 

Established in 1974, the SDWA provides the basis for drinking water security by protecting water 
quality and underground sources of drinking water. It applies to public water systems, including 
pipes and other constructed conveyances. The SDWA authorizes the U.S. Environmental Protection 
Agency (EPA) to set national standards for drinking water quality and oversees the State, local, and 
water utility implementation of those standards. Under the SDWA, the National Primary Drinking 
Water Regulations (or "primary standards") set enforceable maximum levels for particular 
contaminants in public water systems. These primary standards include requirements for water 
systems to test for these contaminants and to ensure standards are achieved. In addition to setting 
these standards, EPA provides guidance and assistance on drinking water, collects data, and 
oversees State drinking water programs in pursuit of SDWA requirements. 

The law allows States to request drinking water programs, giving them the authority (or "primacy") 
to oversee the program within its borders. Of the 50 States, 49 have "primacy", in addition to the 
Commonwealth of Puerto Rico, and the Navajo Nation. EPA regional offices administer the drinking 


68 EPA, 2015 SSP, 2016. 
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water programs for Wyoming, the District of Columbia, the Virgin Islands, Guam, America Samoa, 
and the Commonwealth of the Mariana Islands. 

Federal Water Pollution Control Act (Clean Water Act) 

The Clean Water Act (CWA) regulates the discharge of pollutants into waters and regulates surface 
water quality standards. It establishes standards for municipal waste treatment and numerous 
categories of industrial point-source discharges (e.g., discharges from fixed sources). It requires 
States and some tribes to enact and implement water quality standards in order to achieve 
designated water-body uses, address water pollutants, and regulate dredge-and-fill activities and 
wetlands. EPA and States with permitting authority have a number of enforcement authorities. 69 

Robert T. Stafford Disaster Relief and Emergency Assistance Act (Stafford Act) 

Typically, States are able to assist utilities during a major disruption but they may not have the 
resources to assist larger systems or regional outages. For large disasters, States seek assistance 
under the Stafford Act. 70 This Act provides the statutory authority for most Federal disaster 
activities. The Act authorizes the delivery of Federal technical, financial, logistical, and other 
assistance to States and localities during declared major disasters or emergencies. Federal 
assistance is provided if an event is beyond the combined response capabilities of State and local 
governments. 71 

Public Health Security and Bioterrorism Preparedness and Response Act 
Title IV of this Act required drinking water facilities serving more than 3,300 customers to conduct a 
vulnerability assessment and develop an Emergency Response Plan (ERP) that addresses assessment 
findings. Facilities must identify plans, procedures, and equipment that can be used in event of a 
terrorist or intentional attack, or used to prevent or mitigate an attack. It also calls on EPA to 
conduct research studies in prevention, detection and response to intentional or terrorist acts that 
potentially disrupt drinking water supply or infrastructure. 72 

PRESIDENTIAL DIRECTIVES AND EXECUTIVE ORDERS 

In addition to the abovementioned laws and statutes, the following presidential directives inform 
Federal policy related to critical infrastructure security and resilience. 

Homeland Security Presidential Directive 5, Management of Domestic 
Incidents (February 28, 2003) 

HSPD-5 directs the Secretary of Homeland Security to develop and administer a National Incident 
Management System (NIMS) to provide a consistent nationwide approach for Federal, State, and 
local governments to work effectively and efficiently together to prepare for, respond to, and 
recover from domestic incidents, regardless of cause, size, or complexity. HSPD-5 also directs the 
Secretary to develop and administer a National Response Plan (NRP) to integrate Federal 


69 EPA, 2015 SSP, 2016. 

70 EPA, Planning for an Emergency Drinking Water Supply, 2011. 

71 Ibid. 

72 EPA, 2015 SSP, 2016. 
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Government domestic prevention, preparedness, response, and recovery plans into one all¬ 
discipline, all-hazards plan. 

Presidential Policy Directive 8, National Preparedness (March 30, 2011) 

PPD-8 calls on Federal agencies to work with the whole community to achieve the goal of a secure 
and resilient Nation through developed capabilities "to prevent, protect against, mitigate, respond 
to and recover from the threats and hazards that pose the greatest risk." It is organized around the 
following main elements: National Preparedness Goal (the end to achieve), National Preparedness 
System (the means to achieve the goal), National Planning Framework (describes how the whole 
community works together to achieve the goal), and National Preparedness Report (measures 
progress toward the goal). 

Presidential Policy Directive 21, Critical Infrastructure Security and Resilience 
(February 12, 2013) 

PPD-21 provides the national approach to protecting critical infrastructure. It defines critical 
infrastructure broadly, to include cyber, as well as physical structures. PPD-21 expands the view of 
critical infrastructure threats from the previous terrorism perspective to an all-hazards approach. It 
advances a national unity of effort to strengthen and maintain secure, functioning, and resilient 
critical infrastructure across the spectrum of prevention, protection, mitigation, response, and 
recovery. 

Executive Order 13636, Improving Critical Infrastructure Cybersecurity 
(February 12, 2013) 

EO 13636 addresses how the Federal Government will help prevent, mitigate, and respond to the 
rise of cyber intrusions into the United States' critical infrastructure while, at the same time, 
maintaining a cyber infrastructure that protects privacy and confidentiality. 

Executive Order 13690, Establishing a Federal Flood Risk Management 
Standard and a Process for Further Soliciting and Considering Stakeholder 
Input (January 30, 2015) 

EO 11988—Floodplain Management, issued in May 1977, requires Federal agencies to avoid—to the 
extent possible—long- and short-term adverse impacts associated with the occupancy of flood 
plains, in addition to avoiding direct/indirect support of floodplain development if there is a 
practicable alternative. It is designed to reduce the risk of flood loss; minimize the impact of floods 
on human safety, health, and welfare; and restore/preserve the flood plains. EO 11988 was 
amended by EO 13690 which established the Federal Flood Risk Management Standard (FFRMS) to 
improve resilience to current and future flood risks. It provides three approaches that Federal 
agencies can use to establish the flood elevation and hazard area for consideration in their decision¬ 
making: climate-informed science approach, adding two to three feet of elevation to the 100-year 
floodplain, and using the 500-year floodplain. 


NIAC Water Sector Resilience Final Report and Recommendations 


124 


OTHER FEDERAL GUIDANCE 


National Infrastructure Protection Plan 2013: Partnering for Critical 
Infrastructure Security and Resilience (NIPP 2013) 

NIPP 2013 guides the national effort to manage risk to the Nation's critical infrastructure. NIPP 2013 
builds upon previous plans by emphasizing the complementary goals of security and resilience for 
critical infrastructure. To achieve these goals, cyber and physical security and the resilience of 
critical infrastructure assets, systems, and networks are integrated into an enterprise approach to 
risk management. The national plan also establishes a vision, mission, and goals that are supported 
by a set of core tenets focused on risk management and partnership to influence future critical 
infrastructure security and resilience planning at the international, national, regional, State, local, 
tribal and territorial governments, and owner and operator levels. NIPP 2013 further organizes 
critical infrastructure into 16 sectors and designates a Federal department or agency as the lead 
coordinator—Sector-Specific Agency (SSA)—for each sector. 73 

National Response Framework (NRF) 

The NRF is a component of the National Preparedness System mandated in PPD 8: National 
Preparedness of March 2011. PPD-8 defines five mission areas - prevention, protection, mitigation, 
response, and recovery - and mandates the development of a series of policy and planning 
documents to explain and guide the Nation's collective approach to ensuring and enhancing national 
preparedness. The NRF is a guide to how the Nation responds to all types of disasters and 
emergencies. It is built on scalable, flexible, and adaptable concepts identified in the NIMS to align 
key roles and responsibilities across the Nation. 

The NRF is composed of a base document, Emergency Support Function (ESF) Annexes, Support 
Annexes, and Incident Annexes. The ESF Annexes describe the Federal coordinating structures that 
group resources and capabilities into functional areas that are most frequently needed in a national 
response. Support Annexes describe the essential supporting processes and considerations that are 
most common to the majority of incidents. Incident Annexes describe the unique response aspects 
of incident categories. 

EPA participates in the NRF in multiple ways. EPA is the coordinator for ESF #10 - Oil and Hazardous 
Materials Response and is a support agency for several Emergency Support Functions, including: 74 

• ESF #3 - Public Works and Engineering 

• ESF #4 - Firefighting 

• ESF #5 - Emergency Management 

• ESF #8 - Public Health and Medical Services 

• ESF #11 - Agriculture and Natural Resources 

• ESF #12-Energy 


73 DHS, NIPP 2013, 2013. 

74 FEMA, National Response Framework, 2013. 
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• ESF #13 - Public Safety and Security 

• ESF #14 - Long-Term Community Recovery 

• ESF #15 - External Affairs 

National Disaster Recovery Framework (NDRF) 

The NDRF is a guide that enables effective recovery support to disaster-impacted States, Tribes, 
Territorial and local jurisdictions. The NDRF provides a flexible structure that enables disaster 
recovery managers to operate in a unified and collaborative manner. It also focuses on how best to 
restore, redevelop and revitalize the health, social, economic, natural and environmental fabric of 
the community and build a more resilient Nation. 75 

In September 2012, two-thirds of the United States was affected by drought. The President 
convened the White House Rural Council to address efforts to mitigate the impact of the drought by 
utilizing all resources. The NDRF was used to coordinate the response. In June 2013, the President 
released his Climate Action Plan. Later in that year the National Drought Resilience Partnership 
(NDRP) was formed as part of that effort. 76 

National Earthquake Hazards Reduction Program (NEHRP) 

The National Institute of Standards and Technology (NIST) is designated by Congress as the Lead 
Agency for the NEHRP. The NEHRP Office oversees several programs and projects, including those 
seeking to understand the dynamic of earthquakes and their impact on critical infrastructure and to 
develop and deploy improved prescriptive seismic provisions in U.S. model building codes and 
standards. EPA works with NIST to help citizens prepare for an earthquake, with an emphasis on 
water safety and security. 77 

II. FEDERAL AGENCIES 


In addition to State and local agencies, Federal agencies share in the mission to protect public 
health and the environment. This section outlines the primary Federal agencies that maintain 
relationships and interactions with the Water Sector. EPA has the predominant role, with 
responsibility for the enactment of the Clean Water Act and Safe Drinking Water Act. In addition, it 
serves as the SSA for the sector. EPA regularly communicates and coordinates with the U.S. 
Department of Homeland Security (DHS) on Water Sector security, and works with DHS to 
implement presidential directives, executive orders, and statutes. The Water Sector, EPA, DHS, and 
other Federal agencies share in the mission to protect public health and the environment through 
secure and resilient drinking water and wastewater infrastructure. 

The Water Sector Government Coordinating Council (GCC)—composed of Federal and State 
government representatives and national associations—is chaired by EPA, with DHS serving as co¬ 
chair. In addition to EPA and DHS, the Federal agencies listed under Other Federal Partners, serve on 


75 FEMA, "National Disaster Recovery Framework," 2015. 

76 NIDIS, "National Drought Resilience Partnership." 

77 National Earthquake Hazards Reduction Program, "Background & History," 2016. 
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the GCC. These Federal agencies maintain relationships and interactions with the Water Sector in 
pursuit of Water Sector resilience, and are discussed in the following paragraphs. 

The following sections discuss the roles of EPA and DHS—the GCC chair and co-chair along with the 
other agency representatives in the GCC. 

U.S. ENVIRONMENTAL PROTECTION AGENCY 

EPA is charged with executing SSA responsibilities for the Water Sector. Significant EPA components 
involved in Water Sector resilience include: EPA Headquarters, the Office of Water (OW), and the 
Office of Solid Waste and Emergency Response (OSWER). Exhibit F-l shows the organizational 
structure for EPA, and where the Office of Water is located. 

Exhibit F-1. EPA Organizational Chart for Water 78 
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Within EPA Headquarters, there are key offices which have programs related to Water Sector 
security and resilience. These include: 


78 EPA, 2010SSP, 2010. 
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Office of Homeland Security (OHS), which provides Agency-wide leadership and coordination for 
homeland security policy, including EPA's planning, prevention, preparedness, and response for 
homeland security-related incidents. 79 Programs administered by OHS are: 

• Homeland Security Collaborative Network 

• Homeland Security strategic planning 

• Pandemic flu preparedness and response 

• Nuclear Incident Response Team Interagency Agreement 

Office of Policy (OP), which has special expertise in five areas: regulatory policy and management, 
environmental economics, strategic environmental management, sustainable communities, and 
climate adaptation. 80 OP programs most relevant to resilience comprise climate-resilience programs. 
Examples include: 

• Mainstream climate adaptation planning into EPA's programs, policies, rules and operations 
to ensure they are effective under future climatic conditions. 

Support climate-resilient investments by States, tribes, and local communities by integrating 
climate adaptation criteria into financial mechanisms (grants, cooperative agreements, 
contracts, and technical assistance agreements). 

Chair the Federal Agency Adaptation Work Group established by the White House Council 
on Climate Preparedness and Resilience to support the development and implementation of 
all agencies' climate change adaptation plans. 

EPA Office of Water 

The Office of Water (OW) ensures drinking water is safe, and restores and maintains oceans, 
watersheds, and their aquatic ecosystems to protect human health, support economic and 
recreational activities, and provide healthy habitat for fish, plants and wildlife. OW is responsible for 
implementing the CWA and SDWA, and several other statutes. 

Several offices within OW have important programs related to Sector security and resilience. These 
include: 

Immediate Office of the Assistant Administrator for Water (10), which produced a study on 
The Importance of Water to the U.S. Economy 81 and which addresses Climate Change in the 
Water Sector. EPA's climate change program is extensive and links to various aspects of the 
program may be found on the 10 Climate Change Website. 82 

Office of Ground Water and Drinking Water (OGWDW), which has programs and projects 
dealing with Drinking Water Contaminants, Drinking Water Basics, Drinking Water 
Standards, Local Drinking Water, Public Drinking Water Systems, Small Public Drinking 


79 EPA, "About the Office of Homeland Security (OHS)," 2016. 

80 EPA, "About the Office of Policy (OP)," 2016. 

81 EPA, The Importance of Water to the U.S. Economy, 2013. 

82 EPA, "Addressing Climate Change in the Water Sector," 2016. 
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Water Systems, Source Water Protection, Sustainable Water Infrastructure, Underground 
Injection Control, Water Security, and Private Drinking Water Wells. 83 Within this office, the 
Water Security Division works to prevent, respond to, and recover from hazards, including 
maintaining a resilient infrastructure. 

Office of Science and Technology (OST), which is responsible for developing sound, 
scientifically defensible standards, criteria, advisories, guidelines and limitations under the 
CWA and SDWA OST produces regulations, guidelines, methods, standards, science-based 
criteria, and studies that are critical components of national programs that protect people 
and the aquatic environment. 

Office of Wastewater Management (OWM), which supports the FCWA, by promoting 
effective and responsible water use, treatment, disposal and management and by 
encouraging the protection and restoration of watersheds. Important programs managed by 
OWM include Biosolids, Combined Sewer Overflows and Sanitary Sewer Overflows, Green 
Infrastructure, Municipal Technologies, National Pollutant Discharge Elimination System 
(NPDES) program, Septic (Decentralized) Systems, Wastewater in Small Communities, 
Stormwater, Sustainable Water Infrastructure, and the WaterSense Program. 84 

Water Infrastructure and Resiliency Finance Center identifies financing approaches to help 
communities make better informed decisions for drinking water, wastewater, and 
stormwater infrastructure that are consistent with local needs. The center seeks to 
accelerate and improve the quality of water infrastructure by promoting: 

o Effective use of Federal funding programs 

o Leading edge financing solutions 

o Innovative procurement and partnership strategies 

o Collaborative financial guidance and technical assistance efforts 

o Data and learning clearinghouses that support effective decision-making 85 


EPA Office of Solid Waste and Emergency Response (OSWER) 

The OSWER provides policy, guidance, and direction for EPA's emergency response and waste 
programs. The Office develops guidelines for the land disposal of hazardous waste and underground 
storage tanks, as well as provides technical assistance to all levels of government to establish safe 
practices in waste management. 86 Emergency management and response is managed by OSWER. 
This important program is responsible for responding to oil spills, chemical, biological, radiological 
releases, and large-scale national emergencies under the National Response System. EPA also 
provides additional response assistance when State and local first-responder capabilities have been 
exhausted or when additional support is requested. 87 


83 EPA, "About the Office of Water," 2016. 

84 EPA, "About the Office of Wastewater Management," 2016. 

85 EPA, "About the Water Infrastructure and Resiliency Finance Center," 2016. 

86 EPA, "About the Office of Land and Emergency Management (OLEM)," 2016. 

87 EPA, "Emergency Response," 2016. 
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EPA Regional Offices 

EPA has 10 regional offices responsible for executing the agency's programs in States and 
territories. 88 Under the SDWA, States can request authority to oversee their drinking water 
programs, also known as primacy. There are 49 States, the Commonwealth of Puerto Rico, and the 
Navajo Nation have primacy. EPA regional offices administer drinking water programs for other 
entities that do not have primacy including other sovereign tribal nations, Wyoming, the District of 
Columbia, the Virgin Islands, Guam, American Samoa, and the Commonwealth of the Mariana 
Islands. 89 


U.S. DEPARTMENT OF HOMELAND SECURITY 

EPA communicates and coordinates with DHS to implement presidential directives, executive 
orders, and statutes related to Water Sector security and resilience. The DHS Office of Infrastructure 
Protection is the primary point for EPA communication and coordination on critical infrastructure 
security and resilience activities. 

EPA has a designated liaison to DHS, who helps to coordinate and share information between EPA, 
DHS, and other Federal sector partners on issues pertaining to drinking water and wastewater 
systems. The liaison helps to provide insight on vulnerability and consequence issues that directly 
impact Water Sector utilities. This coordination improves DHS' ability to interpret water-related 
threat information and to develop and distribute timely and accurate threat-warning products that 
are relevant to the Water Sector. The DHS Protective Security Advisors conduct assessments of 
nationally significant critical infrastructure, including those in the Water Sector, through security 
surveys, site assistance visits, and incident response. In addition, EPA and FEMA have close 
collaboration in a number of key areas, including activities within the NRF and the incorporation of 
sustainability and smart growth practices into communities' hazard mitigation and long-term 
disaster recovery efforts. 90 

OTHER FEDERAL PARTNERS 

The following are the six Federal agencies that serve on the Water Sector GCC in addition to the EPA 
(chair) and DHS (co-chair). 

Federal Bureau of Investigation (FBI) 

The FBI interacts with the Water Sector through threat information sharing. The FBI works closely 
with EPA, DHS, and the WaterlSAC to share intelligence and threat warnings related to physical and 
cyberattacks and to contamination incidents. Drinking water and wastewater utilities, as well as 
State agencies overseeing Water Sector activity, have been encouraged by EPA to coordinate 
security activities with local FBI offices nationwide. 

U.S. Army Corps of Engineers (USACE) 

The U.S. Department of Defense (DOD) primarily interacts with EPA through USACE. USACE is 
responsible for maintaining the Nation's commercial waterways and operates the dams and locks; a 

88 EPA, "About EPA," 2016. 

89 EPA, 2015 SSP, 2016. 

90 DHS and EPA, Memorandum of Agreement, 2010. 
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large number of drinking water systems use dammed reservoirs as their primary water sources. Dam 
safety and protection is, therefore, a critical issue for the Water Sector. Employees of the USACE 
Engineering Research and Development Center sit on EPA National Homeland Security Research 
Center's Distribution System Research Consortium. Military facilities with their own drinking water 
and wastewater systems are regulated under the SDWA and CWA and, where applicable, must 
complete and submit vulnerability assessments to EPA. 

U.S. Department of Agriculture (USDA) 

The USDA provides funding and support for small, rural drinking water and wastewater utilities. 

With issuance of Homeland Security Presidential Directive 9 (HSPD-9): Defense of the United States 
Agriculture and Food, USDA expanded its role with EPA to build on and increase current monitoring 
and surveillance programs that provide early detection and awareness of disease, pest, and 
poisonous agents. 

U.S. Department of Health and Human Services (HHS) 

Water and wastewater utilities coordinate with public health agencies during emergency response 
and other water quality-related events, in addition to providing water services necessary for the 
operations of medical and other healthcare facilities. EPA has issued guidance for water utility 
emergency response plans, identifying healthcare facilities and hospitals as particularly critical users. 
Common practice entails water utilities and healthcare facilities working together to develop 
effective plans to sustain hospital functions when water supplies are disrupted. 91 

U.S. Department of the Interior (DOI) 

EPA coordinates with DOI on dam security and water quality. The National Park Service (NPS) 
maintains drinking water and wastewater utilities, under their purview, that are regulated by the 
SDWA and CWA. The Bureau of Land Management (BLM) plays a role in managing the Western 
water supply—some drinking water sources reside on BLM-managed public lands. 

U.S. Department of State 

Several major rivers, which are used as drinking water sources in the United States, cross Canada 
and Mexico borders. In addition, some Water Sector utilities obtain their treatment chemicals from 
Canada. The U.S. Department of State collaboratively works with other countries to ensure the 
protection of Water Sector infrastructure and water sources with an international nexus. 

III. FEDERAL ACTIVITIES 


Federally supported resilience activities in the Water Sector support the Sector's vision, mission, 
goals and objectives for resilience, as well the priority activities described in the 2015 Water and 
Wastewater Systems Sector-Specific Plan (2015 SSP). 92 EPA is the Sector-Specific Agency (SSA) for 
the sector and as such, most Federal resilience activities in the Water Sector take place under EPA. 


91 CDC and AWWA, Emergency Water Supply Planning Guide for Hospitals and Health Care Facilities, 2012; and 
Welter, et al, "Cross-Sector Emergency Planning for Water Providers and Flealthcare Facilities," 2010. 

92 EPA, 2015 SSP, 2016. 
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EPA ACTIVITIES 

The following describe major EPA activities related to resilience planning and assistance. 

EPA Strategic and Programming Planning 

EPA has several strategic and planning documents to advance its priorities and mission to protect 
human health and the environment. The fiscal year 2014-2018 Strategic Plan references resilience in 
support of the President's Climate Action Plan (June 2013); specifically, to build resilience for 
extreme weather events. 93 One of the five agency FY 2016-2017 Agency Priority Goals is to "advance 
resilience in the nation's water infrastructure, while protecting public health and the environment, 
particularly in high-risk and vulnerable communities." To achieve this, EPA will provide technical 
assistance and tools to 25 urban communities to advance green infrastructure to improve local 
climate resilience. EPA will also provide resilience tools and training (on regional-based threats) to 
1,000 small water utilities. 94 In addition, the Water Security Initiative (WSi) is an EPA program that 
addresses the risk of contamination of drinking water distribution systems. Its implementation 
includes the development of practical guidance and outreach to promote voluntary national 
adoption of effective and sustainable drinking water contamination warning systems. 95 

National Water Program (NWP) 2012 Strategy: Response to Climate Change (December 

2012 ) 

The first EPA NWP Strategy was published in 2008 and identified more than 40 key actions that 
could be taken in the near-term to understand and address the potential impacts of climate change 
on water resources. The 2012 NWP Strategy describes long-term goals for the management of 
sustainable water resources and identifies strategic actions that would need to be taken to achieve 
those goals. As such, the 2012 Strategy is a roadmap to guide future programmatic planning within 
EPA. 

Coordination with Emergency Management Agencies 

EPA developed two documents to help further the coordination and integration of the Water Sector 
and emergency management community. 

Coordination of the Water and Emergency Services Sector discusses the value of water to 
the emergency management community, and provides recommendations on how utilities 
can work together with their local emergency management agency. 96 

Bridging the Gap focuses on the relationships between State drinking water primacy 
agencies and State emergency management agencies. 97 


93 EPA, FY2014-2018 EPA Strategic Plan, 2014. 

94 EPA, Office of the Chief Financial Officer, FY2017 EPA Budget in Brief, 2016. 

95 EPA, "Drinking Water and Wastewater Resilience," 2016. 

96 EPA, Coordination of the Water and Emergency Services Sectors, 2012. 

97 EPA and ASDWA, Bridging the Gap, 2013. 
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Water Infrastructure and Resiliency Finance Center Activities 

The Center provides objective financial advice to help communities make informed decisions on 

financing drinking water, wastewater, and stormwater infrastructure projects. Current activities 

include: 98 

Regional Finance Forums: These forums bring together communities with water 
infrastructure financing needs in an interactive peer-to-peer networking format. Attendees 
hear how local utilities have financed resilient water infrastructure projects and have the 
opportunity to meet key regional funding and technical assistance contacts. 

WaterCARE Program: The Community Assistance for Resiliency and Excellence (WaterCARE) 
program supports communities in developing resilient and sustainable finance planning 
strategies for drinking water and wastewater infrastructure to meet long-term local needs. 
Project successes are shared to support decision-making for other communities that have 
similar water infrastructure financing needs. 

Innovative State Revolving Fund Financing: The Center is launching a State Revolving Fund 
(SRF) Peer-to-Peer Learning Program with the Council of Infrastructure Financing Authorities 
(CIFA) and engaging in other SRF outreach on state-of-the-art practices. 

Partnerships: The Center is initiating a Water Infrastructure Public-Private Partnership 
Study and Local Government Training with the University of North Carolina Environmental 
Finance Center and West Coast Exchange. The Center is working with its partners to 
promote new tools such as EPA Region 3's "Community-Based Public-Private Partnerships 
Guide for Local Governments" to explore alternative market-based tools for integrated 
green stormwater infrastructure. 

Stormwater Financing Clearinghouse: The Center is focusing on stormwater financing by 
developing a clearinghouse of information to support communities to develop dedicated 
sources of revenue for stormwater programs. 

EPA Water Security Division Activities 

Most of the current and projected programs of EPA Water Security Division (WSD) for fiscal year 
2016 focus on actions designed to support the implementation of one or more of the Water Sector's 
priority activities (as outlined in the 2015 SSP). These activities include: 

Supporting coordination with other sectors to improve relationships, develop mitigation and 
response plans, and improve response and recovery following an incident. 

Holding workshops and training focused on community-based water resilience, including 
how to use tools available to assess current levels of preparedness. 

• Coordinating and facilitating exercises with WARN and at the State level to highlight the 
importance of cross-agency coordination and the criticality of water during a major incident. 

Working at the regional level with clusters of utilities facing a common hazard to implement 
mitigation measures. 


98 EPA, "About the Water Infrastructure and Resiliency Finance Center," 2016. 
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Developing educational materials, training, and guidance for State primacy agencies, 
utilities, and decision-makers on cybersecurity and mitigation measures. 




DHS COLLABORATION: SECTOR RESILIENCE ACTIVITIES 

The following are key examples of major collaborative activities supported by DHS. 

CIPAC Projects and Activities to Support a Secure and Resilient Water Sector 
(March I, 2010) 

The Critical Infrastructure Partnership Advisory Council (CIPAC) Emergency Preparedness, Response, 
and Recovery Workgroup produced a document of projects and activities to support Water Sector 
Strategic Planning Working Group priorities. The Workgroup identified some 35 projects and 
activities, including the following top ten: 

• Improve Emergency Response Plan (ERP) Guidance 

• Outreach Targeted to Utility Managers 

• Fact Sheet(s) on ERP Requirements, Hazards & Consequences 

• Checklist for Coordination with Local Emergency Management 

• Develop an Enhanced Crisis Communication Workbook 

• Produce Business Case for Preparedness 

• Create an Emergency Operations Center (EOC) Water Desk Manual 

• Improve Opportunities for Mutual Aid Across State Lines 

• Fact Sheet on Utilities being First Responders 

• All-Hazard Example Decision Trees for Specific Incidents 

Contamination Warning System CIPAC Workgroup: Final Report (March 
2012) 

The CIPAC Contamination Warning System Workgroup produced a report of 10 findings, in addition 
to specific objectives and priorities, within two charge areas: 1) the structure of a national program 
to promote adoption of CWS practices, and 2) the gaps identified in the current development and 
understanding of CWS components. This document is a primary source of recommendations dealing 
with national contamination warning issues. 

CIPAC Roadmap to a Secure & Resilient Water Sector (May 2013) 

Developed by the CIPAC Water Sector Strategic Priorities Working Group, the Roadmap establishes a 
strategic framework that articulates the priorities of industry and government in the Water Sector to 
manage and reduce risk. It also produces an actionable path forward for the Water Sector 
Government Coordinating Council (Water Sector GCC), Water Sector Coordinating Council (Water 
SCC), and government and private sector security partners in the Sector to improve the Sector's 
security and resilience within the next five years. The 2015 SSP identifies this document as a 
blueprint to be used for enacting the priorities and goals with the Water Sector. 
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The Roadmap establishes three top priority activities for the Water Sector: 1) Advance the 
development of sector-specific cybersecurity resources; 2) Raise awareness of the Water Sector as a 
lifeline sector and recognize the priority status of its needs and capabilities; and 3) Support the 
development and deployment of tools, training, and other assistance to enhance preparedness and 
resilience. The Roadmap further describes the opportunities, challenges to implementation, efforts 
needed to achieve these goals, and roles and responsibilities within the Sector to successfully 
implement each of the priority activities. 

CIPAC Water Sector Cybersecurity Strategy Workgroup: Final Report & 
Recommendations (April 2015) 

The CIPAC Water Sector Cybersecurity Strategy Workgroup generated recommendations related to 
the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework). 99 
The report identifies gaps in available guidance, tools, and resources for addressing the 
Cybersecurity Framework in the Sector; and identifies measures of success that can be used by 
Federal agencies to indicate the extent of use of the Cybersecurity Framework in the Water Sector. 

It provides specific recommendations to achieve each of the four objectives above. Although EPA is 
responsible for regulating the security of critical infrastructure in the Water Sector, EPA believes 
that the voluntary partnership model is the best approach for implementing the Cybersecurity 
Framework in the Sector and therefore participated in and supported the CIPAC workgroup 
cybersecurity report. 

Water and Wastewater Systems Sector-Specific Plan (2015 SSP) 

The 2015 SSP addresses risk-based critical infrastructure protection strategies for drinking water and 
wastewater utilities, regulatory primacy agencies, and technical assistance partners. This includes 
processes and activities to enable the protection, and increased resilience, of the Sector's 
infrastructure. The 2015 SSP serves as a blueprint to be used for enacting the priorities and goals 
outlined within the Roadmap to a Secure and Resilient Water Sector and NIPP 2013, and provides an 
overarching framework for integrating sector critical infrastructure and key resource protection 
efforts into a unified program. 

IV. FEDERAL FUNDING 


There are two primary sources of Federal funds. EPA provides funding to address water-quality 
goals, and DHS through FEMA provides grants for disaster mitigation. For the latter, water services 
are only one of the many areas that qualify for support. 

ENVIRONMENTAL PROTECTION AGENCY FUNDING 

Clean Water State Revolving Fund 

The Clean Water State Revolving Fund (CWSRF) is a partnership between EPA and the States to help 
States finance water infrastructure projects. Under the program, Congress appropriates funding to 
EPA that then provides grants to the States, which must contribute an additional 20 percent to 


99 NIST, Framework for Improving Critical Infrastructure Cybersecurity, 2014. 
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match the Federal grants. From this pool of money, the States finance low interest loans for eligible 
water infrastructure projects. As loans are repaid, the money goes into the State programs to 
finance new projects. 100 Using a combination of Federal and State funds, State CWSRF programs 
provide loans to eligible recipients to: 

• Construct municipal wastewater facilities 

• Control nonpoint sources of pollution 

• Build decentralized wastewater treatment systems 

• Create green infrastructure projects 

• Protect estuaries 

• Fund other water quality projects 

Drinking Water State Revolving Fund 

Similar to the CWSRF, the Drinking Water State Revolving Fund (DWSRF) is a partnership between 
the Federal Government and State governments to help finance water infrastructure projects 
focused on providing safe drinking water. Under the program, Congress appropriates money for the 
fund, EPA awards grants to each State. The grant amount is based on the results of the Drinking 
Water Infrastructure Needs Survey and Assessment. States must provide a 20 percent match of any 
funding received, and as loans are repaid they flow back into the pool of money used to fund 
additional loans and projects. 101 Eligible projects include: 

• Improving drinking water treatment 

• Fixing leaky or old pipes (water distribution) 

• Improving source of water supply 

• Replacing or constructing finished water storage tanks 

• Other infrastructure projects needed to protect public health 

Water Infrastructure Finance and Innovation Act (WIFIA) 102 

WIFIA (authorized in 2014) establishes a new financing mechanism for water and wastewater 
infrastructure projects under EPA. It was modeled after the Transportation Infrastructure Finance 
and Innovation Act (authorized in 1998, amended in 2005) and is designed to fill market gaps and 
leverage private co-investment. 

Although separate from the SRF programs, the WIFIA program works in coordination to provide 
low-interest loans for up to 49 percent of the costs of projects that are nationally or regionally 
significant. It is intended to increase flexibility for non-Federal interests and leverage private sector 
investments to increase the effect of Federal funding. The new SRF provisions provide loan 
flexibility, lower interest rates and extended repayment periods of 30 years. Examples of 


100 EPA, "Learn about the Clean Water State Revolving Fund (CWSRF)," 2016. 

101 EPA, "How the Drinking Water State Revolving Fund Works," 2015. 

102 EPA, "Learn About the Water Infrastructure Finance and Innovation Act Program," 2015. 
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eligible projects include projects to enhance energy efficiency at drinking water and wastewater 
facilities, and desalination, aquifer recharge, and water recycling projects. Qualifications include: 

• Funded projects must be nationally or regionally significant 

Individual projects must be reasonably anticipated to cost no less than $20 million 

A. U.S. DEPARTMENT OF HOMELAND SECURITY 
FUNDING 103 

Hazard Mitigation Grant Program (HMGP) 104 

The HMGP assists States, Tribes, and local communities in implementing long-term hazard 
mitigation measures following a major disaster declaration. The program's objectives are to 
significantly reduce or permanently eliminate future risk to lives and property from natural hazards; 
provide funds to implement projects in accordance with priorities identified in State, Tribal, or local 
hazard mitigation plans; and enable mitigation measures to be implemented during the recovery 
from a disaster. 

The HMGP can be used to fund projects to protect either public or private property, as long as the 
project fits within State and local government mitigation strategies to address areas of risk and 
complies with HMGP guidelines. Examples of projects include: acquiring and relocating structures 
from hazard-prone areas; retrofitting structures to protect them from floods, high winds, 
earthquakes, or other natural hazards, and constructing certain types of minor and localized flood 
control projects. HMGP funding is also available following a major disaster declaration if requested 
by the Governor. 

Pre-Disaster Mitigation (PDM) Grant Program 105 

The PDM Grant Program is designed to assist States, territories, federally recognized tribes, and 
local communities in implementing a sustained pre-disaster natural hazard mitigation program. The 
goal is to reduce overall risk to the population and structures from future hazard events, while also 
reducing reliance on Federal funding in future disasters. This program awards planning and project 
grants and provides opportunities for raising public awareness about reducing future losses before 
disaster strikes. 


103 DHS, Congressional Budget Justification (FY 2017) 

104 FEMA, "Hazard Mitigation Assistance," 2016. 

105 FEMA, "Pre-Disaster Mitigation Grant Program," 2016. 
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APPENDIX G. 

BASELINE RESILIENCE IN THE WATER SECTOR 


Resilience is part of the Water Sector's culture, because the safe and reliable delivery of water and 
wastewater services, particularly under normal, nonstressed conditions, is ingrained in the sector's 
business model. However, throughout the sector there is wide variability in the degree to which 
Water Sector utilities have implemented specific resilience practices to respond to stressed 
conditions. Determining factors for resilience level include utility size, area of responsibility, and 
scale; complexity of the utility's operations; public versus private ownership; and the nature of 
perceived threats and risks. 

This appendix includes an overview of the sector's components, risks, aspects of resilience, and 
resilience practices. 

I. SECTOR OVERVIEW 


The infrastructure of the Water Sector is complex, but its principal infrastructure can be grouped 
into drinking water and wastewater categories of varying sizes and ownership types. 106 This section 
provides an overview of drinking water and wastewater systems, the underlying value to the 
Nation's public health and economy, and the extensive role of collaboration in aligning public and 
private interests. 

Most of the larger public drinking water systems and treatment works, which serve the major of 
Americans, are owned and operated by municipal entities. However, private water companies own 
nearly 16 percent of the Nation's Community Water Systems, and around 2,000 government entities 
contract with private companies to provide water and/or wastewater service in a public-private 
partnership. 107 

DRINKING WATER 

Key infrastructure in the public drinking water systems of the Sector include: 108 

Raw Water Supply (e.g., surface water, groundwater): Surface water includes lakes, 
reservoirs, and rivers. Groundwater primarily includes water held in aquifers. 

Raw Water Transmission (e.g., conduits, pipelines, catch basins): Conduits are covered 
tunnels and pipelines conveying raw water to treatment facilities. Pipelines include the 
entire system of pipes, interconnections, and valves that may be underground, above 
ground, or across rivers. Catch basins are used in combined sewer systems to catch excess 
wastewater and stormwater where it is held for later treatment and disposal. 

Raw Water Storage (e.g., reservoirs, tanks): Reservoirs may be located in remote or urban 
areas, and vary widely in size. Storage tanks are also used to hold water prior to treatment. 


106 EPA, 2015 SSP, 2016. 

107 NAWC, "The Truth about Private Water Service Providers," 2010. 

108 EPA, 2015 SSP, 2016. 
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Water Treatment Facility: Includes a wide range of facilities that provide safe, potable 
water for domestic use; adequate water under sufficient pressure for fire protection and 
other emergencies; and industrial water for manufacturing. Steps to treat water include 
clarification, coagulation, sedimentation, filtration, and the use of chemicals in disinfection 
and fluoridation. 

Treated/Finished Water Storage: Includes water towers, standpipes, and covered and 
uncovered reservoirs that store treated water for a short period of time until it can be 
distributed to users. 

Treated Water Distribution System: Includes main water transmission pipes, water service 
lines to end users, water distribution pumping stations, fire hydrants, booster disinfection 
facilities to add additional disinfectant to treated water, backflow preventers to prevent 
contaminated water from entering the distribution network, and meters to track 
consumption of water. 

Treated Water Monitoring System: Includes facilities to monitor treated water quality for 
contaminants, and can include sensors to monitor water pressure and water quality. 

Treated Water Distribution Control Center: Includes central control facilities that monitor 
and operate the distribution system. Often, the facilities house supervisory control and data 
acquisition (SCADA) systems as part of an integrated control system. Some centers utilize 
electronic networks to connect monitoring systems and controls to a central display and 
operations room. 

There are approximately 153,000 Public Water Systems (PWSs) in the United States. 109 These 
systems provide water for human consumption through pipes or other constructed conveyances to 
at least 15 service connections, or serve an average of at least 25 people, for at least 60 days 
annually. Community Water Systems (CWSs), which serve people year-round in their residences, is 
the largest group of service providers. Exhibit G-l shows the number of community water systems by 
size. 


109 EPA, 2015 SSP, 2016. 
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Exhibit G-l. Number of Community Water Systems and System Size 110 
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WASTEWATER 

Key infrastructure in the public wastewater systems of the Sector include: * 111 

Wastewater Facility (e.g., wastewater collection systems, sewers, inverted siphons, 
manholes, combined sewer/overflow outfall locations, lift/pump stations, and catch 
basins): Wastewater collection systems are the network of pipes that conveys wastewater 
from the source to the treatment plant. In some older cities, the wastewater and 
stormwater collection systems are integrated (combined sewer systems). In these older 
systems, flooding can result in the combined effluent being discharged directly to the 
receiving body (e.g., river or bay), bypassing the treatment plant. 

Wastewater Raw Influent Storage: Includes facilities to store raw sewage prior to 
treatment, including tanks or impoundments. 

Wastewater Treatment Plant: Provide a combination of physical and biological processes 
that are designed to remove organic matter from solution and treat the water to a degree 
that it can be released to the environment. Processes include screening, grit removal, 
flotation, flocculation and sedimentation, aeration, clarification, disinfection, chemical 
coagulation, and filtration. The processes are applied to the plant influent to reduce 
pollutant levels to the concentrations specified in the National Pollutant Discharge 
Elimination System (NPDES) permit, in the case of a direct discharger, or other specified 
discharge limits, in the case of an indirect discharger. 


110 EPA, 2015 SSP, 2016. 

111 Ibid. 
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Treated Wastewater Storage: Includes facilities where treated wastewater is held prior to 
discharge. 

Treated Wastewater Discharge System: Includes facilities that discharge treated 
wastewater to a surface water body (directed discharger), or to a POTW collection system 
(indirect discharger). 

Treated Wastewater Monitoring System: Includes facilities that monitor a range of physical 
properties (e.g., flow rates and water-quality indicators) and detect levels of contaminants 
before, during, and after wastewater treatment. 

Wastewater Control Center: Includes central control facilities that monitor and operate the 
wastewater system. Some systems utilize electronic networks, often including wireless 
communication, to link the monitoring system and the controls for the treatment and 
distribution systems to a central display and operations room. SCADA systems are part of an 
integrated control system. 

Wastewater is predominantly treated by Publicly Owned Treatment Works (POTWs); there are 
approximately 16,500 POTWs in the United States. There are also a small number of private 
facilities, such as industrial plants. The majority of wastewater utilities treat less than 1 million 
gallons per day and provide services to fewer than 23 million people in total. 112 Exhibit G-2 shows 
the number of publicly owned treatment facilities by size. 


Exhibit G-2 Number of Publicly Owned Treatment Works and System Size 113 
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THE VALUE OF WATER 

Disruptions to drinking water and wastewater services have far-reaching public health, economic, 
environmental, and psychological impacts as shown in Exhibit G-3. These impacts demonstrate the 
need for improved understanding and support for Water Sector criticality and resilience efforts. 

Exhibit G-3. Water Disruption Impacts 


WHAT HAPPENS WHEN WATER SYSTEMS ARE DISRUPTED? 


The Water Sector represents one of the critical lifeline sectors; safe and reliable water services are 
absolutely fundamental to our way of life. Disrupting these water systems would have far-reaching adverse 
public health, economic, environmental, and psychological impacts. Further, these impacts would not be 
confined to one location but would ripple across the Nation and threaten public confidence in the Nation's 
drinking water and wastewater service. 

Without Water or Wastewater Services the following activities are not possible: 

Individual Use 

Drink water. 

Brush your teeth or shower. 

Use toilet facilities. 

Prepare meals (e.g., boiling food, washing fruits and vegetables). 

Wash clothes and dishes. 

Maintain private pools and water tanks. 

Respond to medical emergencies (e.g., flushing skin/eyes with water to remove a toxin). 

Water lawns, plants, or gardens. 

Public Supply Use 

Treat water and wastewater for any use. 

Maintain public pools, parks, gulf courses, nurseries, cemeteries, or provide water for any 
landscape-watering use. 

Operate critical public health and safety facilities, e.g., hospitals or firefighting capabilities. 

Keep public spaces (e.g., community centers, shopping malls), government offices, or businesses 
open. 

Irrigate for agricultural purposes. The animals (e.g., cows, chickens) depending on this food supply 
will also be affected. 

Industry Supply Use 

Operate thermoelectric power facilities, including for power cooling. 

Maintain major commodity industries that use large amounts of water (food, paper, chemicals, 
refined petroleum, or primary metals). 

Incorporate water into any product, such as for processing, washing, diluting, cooling, or 
transporting a product. 

Extract minerals. 

Maintain livestock systems (watering, feeding, farm needs, sanitation, and waste-disposal). 

( Source: USGS, "Water Use in the United States," 2016.) 
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Public Health Impacts 

Without a safe, clean, and reliable water supply, public health will suffer. Impacts will vary 
depending on the cause of the disruption, such as contaminants in the water system or a lack of 
drinking water and wastewater services. The contaminant type or length of disruption are also key 
variables in the degree of health impact. 

Case in Point 

On January 9, 2014 in Charleston, West Virginia, about 10,000 gallons of a chemical called 4- 
methylcyclohexane methanol (MCHM) leaked from a storage tank into the Elk River. The chemical 
amount overwhelmed the filtration system in the West Virginia American Water (WVAW) treatment 
plant about a mile downstream. 114 Later that day, the WVAW issued a 'do not use' water order and 
the West Virginia Poison Center began receiving calls from people reporting rashes, nausea, 
vomiting, diarrhea, and other symptoms. Little is known about MCHM and its human health effects. 
Studies have only been conducted on animals and they show that when laboratory animals are 
exposed to high doses of MCHM, it causes problems with the liver, kidneys, blood, and the brain. 

On January 21, 2014, it was discovered that another chemical (propylene glycol phenyl ether (PPH)), 
with health effects similar to MCHM, was part of the January 9 release. The most common way 
people were exposed to the contaminants was bathing, showering, washing hands, and other skin 
contact. A study of emergency department visits showed that 356 of 369 people were treated and 
released from the hospital between January 9 and January 23, 2014, with 3.5 percent or people 
hospitalized. 115 Long-term public health impacts are unknown. The incident is an example of the 
need to safely and reliably communicate public health risks. 116 

Economic Impacts 

Businesses are unable to operate without a safe water supply or wastewater services. Facilities such 
as work places, restaurants, shopping malls, and public areas would be forced to shut down. This 
would result not only lost business revenue for the individual companies, but could generate larger 
adverse impacts to the local, State, or national economy. 

Case in Point 

Southern California water services are principally served by the California Aqueduct, which could be 
shut down due a major disaster (e.g., earthquake). In addition to the major disruption to water 
utility services, a 12-month shutdown of the aqueduct water supply would amount to economic 
losses of as much as 550,000 jobs and $55.6 billion in Gross Domestic Product (GDP) to the Los 
Angeles County Economy. A 24-month disruption could lead to a total two-year loss of 742,000 job- 
years of employment, $75 billion of GDP, and $135 billion of sales revenue for businesses in the 
county. 117 


114 Friend, "Water in American: Is It Safe to Drink?" 2014. 

115 WV DHHR, "Elk River Chemical Spill," 2014. 

116 Manuel, "Crisis and Emergency Risk Communication," 2014. 

117 Rose, et al.. Total Regional Economic Losses from Water Supply Disruptions to the Los Angeles County Economy, 2012. 
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Environmental Impacts 

Water disruptions have the potential to impact the broader environment through the pollution of 
water. For example, a sewage overflow or contaminant release can negatively impact plant and 
animal species, affecting the water quality, habitat, and species themselves. 

Case in Point 

Superstorm Sandy generated many critical infrastructure impacts. Due to the storm, power was lost, 
and approximately 80 sewage treatment systems in New Jersey were damaged. One system that 
was damaged was the Passaic Valley Sewerage Commission. During the five days the plant was out 
of commission, approximately 2.75 billion gallons of untreated waste flowed from the plant into the 
nearby bay. 118 From the hardest hit States, 11 billion gallons of untreated and partially-treated 
sewage flowed into the aquatic environment (rivers, bays, canals). Untreated sewage can negatively 
impact the aquatic ecosystem by depleting available oxygen, creating nutrient imbalance, and 
promoting sudden plant growth such as algae blooms, chasing away normal aquatic life. 119 

Psychological Impacts 

A water incident does not have to generate major public health, economic, or environmental 
impacts to result in a major disruption. The loss of public confidence in the water services and the 
threat of spreading fear and panic in the community impacted and across the Nation would 
adversely impact the Water Sector. An unreliable, unclean, and unsafe water supply creates lasting 
fears (e.g., fears of an unknown contaminant's health effects). A prolonged incident could also affect 
the government's ability to maintain order, deliver public services, and ensure public health and 
safety. 

Case in Point 

In August 2014, Toledo was affected from a large algae bloom in Lake Erie, an event that has long- 
troubled the lake. Toxic levels of microcystin meant residents could not use the water supply since 
boiling the water only increased the concentration of toxin. Even after the “Do Not Drink" advisory 
was lifted, the confidence in the water supply did not bounce back. A year later (August 2015), 
another algae bloom threatened the area. Even though the microcystin levels were low and very 
manageable by the water treatment utility, residents began to stockpile bottle water and planned to 
not use tap water—a move that suggests damaged public confidence. 120 Toledo continues to build 
on efforts to regain public confidence; however, restoring public confidence (even with the 
appropriate decontamination) requires significant effort. 

SECTOR COLLABORATION 

Public water and wastewater systems are predominantly owned and operated by municipal entities, 
with the Federal Government role most prominent in the regulation of water quality. The sector has 
a long, productive history of collaboration through associations and geographic clusters of utilities. 
This collaboration has produced a wealth of information, mutual-support relationships, and tools. 

For example, the American Water Works Association (AWWA) developed standard J100-10 (R13) 


118 Manuel, "The Long Road to Recovery: Environmental Health Impacts of Flurricane Sandy," 2013. 

119 Kenward, et al., "Sewage Overflows from Flurricane Sandy," 2013. 

120 Flenry, "Toxic algae struggles leave Toledo's reputation hanging in the balance," 2015. 


NIAC Water Sector Resilience Final Report and Recommendations 


144 



Risk and Resilience Management of Water and Wastewater Systems, the first voluntary consensus 
standard encompassing an all-hazards risk and resilience management process for use specifically by 
water and wastewater utilities. 

Water Sector Coordinating Councils 

The Federal Government built on this tradition of collaboration by using the partnership model, 
specified in Homeland Security Presidential Directive 7 (HSPD-7,); Critical Infrastructure Identification, 
Prioritization, and Protection, Presidential Policy Directive 21 (PPD-21J: Critical Infrastructure 
Security and Resilience, and the 2013 National Infrastructure Protection Plan (NIPP 2013) to bring 
public and private sector participants into the planning and implementation of sector protection. 

EPA organized the Water Government Coordinating Council (GCC) including Federal, State, and local 
entities; and the owners and operators of water utilities organized the Water Sector Coordinating 
Council (Water SCC). 


WATER SECTOR COORDINATING COUNCIL MISSION 


"The Water Sector Coordinating Council shall serve as a policy, strategy, and coordination mechanism and 
shall recommend actions to reduce and eliminate significant critical infrastructure security and resilience 
vulnerabilities to the Water and Wastewater Sector through the interactions with the Federal Government 
and other critical infrastructure sectors." 


The GCC is co-chaired by EPA, the Water SSA, and DHS. The Water Sector GCC coordinates policy, 
strategy, and activities across government entities within the Water Sector, with membership drawn 
from Federal and State government representatives and leaders in water protection and resilience 
issues. 121 The Water SCC member associations serve as liaisons between the broader water services 
community and the government partners represented by the GCC. The current list of Water GCC and 
SCC member organizations is included in Exhibit G-4. 

The Water Sector GCC and SCC often meet under the umbrella of the Critical Infrastructure 
Partnership Advisory Council (CIPAC), established by DFHS to provide a forum in which the 
government and private sector entities, organized as coordinating councils, can jointly engage in 
activities to support and coordinate critical infrastructure security and resilience efforts. Under 
CIPAC, the Water Sector GCC and SCC have formed several working groups to address specific issues 
of security and resilience concern to the sector. 122 In 2015 these working groups included: 123 

• Cybersecurity Working Group 

• Drinking Water Contamination Warning System Working Group 

• Risk Assessment Methodology / Standard Examination Working Group 

• Strategic Planning Working Group 


121 EPA, 2015 SSP, 2016. 

122 EPA, "Water Sector Government Coordinating Council Charter," 2014; and Water SCC, "Charter of the 
Water Sector Coordinating Council," 2014. 

123 DFIS, "Water and Wastewater Systems Sector Working Groups." 
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Exhibit G-4. Water Sector Coordinating Council and Government Coordinating Council 
Membership 124 


Water Sector Government 
Coordinating Council 

Water Sector Coordinating Council 

Association of State Drinking 

American Water 

Water Administrators 

American Water Works Association 

Association of State and Interstate 

Artesian Water Company 

Water Pollution Control 

• Association of Metropolitan Water Agencies 

Administrators 

Bean Blossom-Patricksburg Water Corporation 

Association of State and Territorial 

Boston Water and Sewer Commission 

Health Officials 

Breezy Hill Water and Sewer Company 

Environmental Council of the 

• California Water Service Co. 

States 

County of King (Washington) Department of 

National Association of County & 

Natural Resources and Parks 

City Health Officials 

District of Columbia Water and Sewer Authority 

National Association of Regulatory 

National Association of Clean Water Agencies 

Utility Commissioners 

National Association of Water Companies 

U.S. Department of Agriculture 

National Rural Water and Sewer Authority 

U.S. Department of Defense 

Northeast Ohio Regional Sewer District 

U.S. Department of Health and 

Onondaga County Water Authority 

Human Services 

Prince William County Service Authority 

U.S. Department of Homeland 

Spartanburg Water 

Security 

Symantec Corporation 

U.S. Department of the Interior 

Trinity River Authority of Texas 

U.S. Department of Justice 

• United Water 

U.S. Department of State 

Water Information Sharing and Analysis Center 


II. RISKS TO THE WATER SECTOR 


Secure and resilient water and wastewater infrastructure is essential to daily life and in ensuring the 
economic vitality of the Nation and public confidence in the Nation's drinking water and wastewater 
services. This level of criticality demands the need for effective risk management to successfully 
navigate a broad range of potential disruptions. In fact, emergency response planning is inherent to 
the sector; enabling continuity of such critical operations and sustaining public health and 
environmental protection. 125 In addition, each of the following risks may share other contributing 
factors, such as: 

• Capabilities in managing an area-wide loss of water services may be deficient. 

Although the Water Sector is recognized as a lifeline sector, its lifeline criticality is not 
commonly recognized among all relevant stakeholders. This generates a challenging 
situation, as the lack of recognition can escalate consequences during area-wide events. 


124 DHS, "Water and Wastewater Systems Sector: Council Charters and Membership," 2016. 

125 EPA, 2015 SSP, 2016. 
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The economic costs of preparation and response may mean that there are insufficient 
funds to prepare for and address risks ahead of time and to the level at which the risk 
requires. 

Inadequate information sharing and resources for the full resilience spectrum of prevention, 
protection, mitigation, response, and recovery. 

An aging workforce, resulting in lost institutional knowledge as employees retire. 

Reduced water consumption and conservation results in less revenue available to maintain 
level of service and undertake infrastructure projects. 

Drinking water and wastewater systems rely on a chain of linked components, each of which must 
function well if service is to be provided to the customer. If any of these components or operations 
is disrupted for more than a short period of time, the entire system will shut down. This makes 
water utilities highly vulnerable by nature, and the complexity of their interlinked operations make 
redundancy of many major components almost impossible. 

The Water Sector is proactive in identifying and prioritizing risks to its infrastructure. This enables 
the sector to implement risk-reduction activities through a partnership approach whereby the 
government and the sector share the responsibility for improving Water Sector resilience by 
identifying joint priorities and engaging in coordinated action. At the national level, DHS produces 
risk assessments of the primary risks to each critical infrastructure sector to inform sector owners 
and operators in developing and implementing their risk-management activities. At the sector and 
national level, common significant risks include natural disasters and cyberattacks. 

In 2013, the Water Sector Strategic Priorities Working Group identified the sector's most critical 
risks, organized into categories of most significant, high, and medium. The 2015 SSP reaffirmed the 
continued validity of these risks, as shown in full risk profile listed in Exhibit G-5. Only a few of the 
risks were covered in the body of the report. The risks are not limited to physical or cyber events, 
but rather encompass a much broader spectrum of risk that impacts the sector's overall security and 
resilience and its ability to provide needed water services to the Nation. 
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Exhibit G-5. Water Sector Risks 126 


MOST SIGNIFICANT RISKS 


Natural disasters (such as impacts on water quality and quantity from floods, hurricanes, 
earthquakes, ice storms, pandemic flu, and other geographic catastrophes) 

Economic implications of aging infrastructure 

Cyber events 

Capability in managing an area-wide loss of water 

Although the Water Sector has been defined as a lifeline sector, this is not commonly 
recognized among all relevant stakeholders, a situation that can escalate consequences 
during area-wide events. 


HIGH RISKS 


Economic costs of preparation and response: The Water Sector can create a large economic 
risk in a disaster, but there are insufficient funds to prepare for and address risks ahead of 
time. 

Ignorance about the consequences of inaction and apathy from some stakeholders in 
utilities, the customer base, State and local government, Federal Government and Congress 

Inadequate coordination and information sharing during preparation, response, and 
recovery 

Intentionally malicious acts 

Limited resource availability: Many utilities are faced with competing needs (e.g., regulatory, 
aging infrastructure, environmental, and public health protection, and workforce succession 
requirements) that are immediate, concrete, and can limit resource availability for 
implementing preparedness and resilience improvements 

Unenforced and outdated requirements that do not address evolving threats 


MEDIUM RISKS 


Lack of mutual aid agreements, effective education and outreach to emergency 
management, and lack of best practices for emergency response planning 

Technology interoperability issues that create information-sharing challenges during 
response 

Insufficient communication to water utility boards of the definition, management, and 
prioritization of critical assets and needs 

DHS assesses the overall risk to the Water Sector as "vulnerable to a variety of all-hazard threats 
including contamination with deadly agents, insider threats, physical attacks using improvised 
explosive devices (lEDs), cyberattacks, and natural hazards. Successful attacks on a drinking water or 
wastewater system could result in large numbers of illness, casualties, and denial of service, which 


126 EPA, 2015 SSP, 2016, Figure 4, p. 10. 
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could severely impact the Nation's public health and economic vitality." 127 DHS further identifies the 
most serious risks to the Sector: 

Chemical, Biological, or Radiological (CBR) Contamination. Most public water supplies are 
monitored and treated to prevent the distribution of contaminated drinking water. The risk 
of CBR contamination stems from both the terrorist threat to contaminate the U.S. water 
supply and the serious health impacts that could result from an undetected contaminant. 
These impacts could vary depending on the type of substance, route of exposure (ingestion, 
absorption, inhalation), and amount of time before the contaminant is detected. 

Natural Hazards. Natural hazards (e.g., hurricanes, tornadoes, floods, earthquakes, and 
drought) pose a serious and continuing risk for the Sector. Water infrastructure may be 
severely disrupted or destroyed by such hazards, which may further complicate an overall 
disaster emergency response due to multiple cross-sector interdependencies. Critical water 
shortages may also result from drought conditions and climate change, leading to water use 
restrictions and rationing. 

Physical and Cyberattacks by Terrorists, Homegrown Extremists, or Disgruntled Insiders. 

Physical attacks using improvised explosive devices (lEDs) on chemical storage tanks or 
other critical nodes in a drinking water or wastewater system could result in a release of 
hazardous materials or in a long-term loss of service should a single-point-of-failure be 
destroyed. Cyberattacks and intrusions on SCADA systems or other business systems pose a 
serious threat to the Water Sector, allowing malicious actors to manipulate or exploit 
control systems essential to operation of drinking water and wastewater utilities. 

III. ASPECTS OF RESILIENCE 


Improving resilience in the sector is perhaps best framed by two aspects: the activity and capability 
of the individual utilities and the development and sharing of information, tools, and practices 
through sector collaboration. The following discusses salient elements of each. 

RESILIENCE AT THE UTILITY LEVEL 

Resilience is part of the Sector's culture, because the dependable delivery of safe water and 
wastewater disposal services are inherent in the Sector's business model, whatever the size of the 
utility or jurisdiction managing its resources. The resilience of Sector assets and operations can 
never be taken for granted or allowed to lapse. 

There is wide variability in the degree of resilience at the individual utility level, depending on such 
factors as the size of the utility or managing jurisdiction, its public or private ownership, and the 
scale and complexity of the individual system's operations. For example, the relatively few very large 
systems in the sector—serving the majority of the population—have strong resilience measures in 
place and are heavily monitored and regulated for safety and quality standards set by EPA and 
enforced by the States. However, smaller systems generally do not have access to the same level of 


127 DHS OCIA, Sector Risk Snapshots, 2014. 
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resources as large systems and are not monitored as closely for the enforcement of safety and 
quality standards. 

Some of the most important resilience measures—based on policy, plans, strategies, 
recommendations, and models—are implemented on a regional or local level through regional 
water districts and local utilities. While these measures have proven to strengthen resilience at the 
local or regional level, the practices are not cohesive across the country. Greater emphasis on 
increasing sector-wide availability of resilience practices could further increase resilience both at the 
utility level and the sector level. 

COLLABORATION FOR RESILIENCE AT THE SECTOR LEVEL 

Because of the sector's complexity and the many dependencies that exist in the processes and 
operations providing the public with drinking water and wastewater treatment, the Water Sector 
has robust risk-management procedures and tools in place to ensure the resilience of the sector's 
many assets and systems. Partly because of the resilience differentiation between larger and 
smaller utilities, EPA and associations representing the Water Sector have been very active in trying 
to develop models, tools, and best practices which are transferable to smaller systems. There are 
many examples of this resilience-building approach, as reflected in the Water Sector success stories 
recorded in the 2015 SSP. 128 Some examples of these resilience-building activities include: 

Developed How to Develop a Multi-Year Training and Exercise Plan to assist utilities in 
creating multiyear plans that can lead to increased emergency preparedness. 

The Water Information Sharing and Analysis Center (WaterlSAC) published 10 Basic 
Cybersecurity Measures to Reduce Exploitable Weaknesses and Attacks. 

Published the Weather & Hydrologic Forecasting for Water Utility Incident Preparedness and 
Response document to provide hazardous weather and forecasting resources for utility 
awareness and preparedness. 

Leveraged the CIPAC framework to develop sector priorities, build partnerships, and 
increase collaboration among public and private sector stakeholders, including the 2013 
Roadmap to a Secure & Resilience Water Sector, which represents the Water SCC/GCC 
priorities. 

The Water Research Foundation, AWWA, and EPA developed Business Continuity Planning 
for Water Utilities: Guidance Document. 

Developed the interactive guidance document Flood Resilience: A Basic Guide for Water and 
Wastewater Utilities to help water utilities understand their flooding threat and identify 
practical mitigation options to protect their critical assets. 

The sector identifies and prioritizes programs, projects, and activities which together can strengthen 
sector resilience in the future. As demonstrated in this and the previous section, the sector has set 
specific goals and objectives, identified in detail the infrastructure in the sector, determined how 
risks can be assessed and analyzed, completed and planned a vast array of activities designed to 


128 EPA, 2015 SSP, 2016. 
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address and mitigate Sector risks, identified how to measure success in managing risk in the sector, 
and developed robust information-sharing mechanisms within the sector partnership. All of these 
steps combine to establish a solid baseline of resilience in the sector, while at the same time 
pointing to needed improvements that can be addressed on a priority basis. 

Examples of resilience have been provided in this section in terms of the identification and 
prioritization of sector risks, which have been formalized and compiled by the CIPAC Water Sector 
Strategic Priorities Working Group in the 2013 Roadmap to a Secure and Resilient Water Sector. 
Steps taken or to be taken by the sector in terms of its cybersecurity resilience have also been 
discussed above, in terms of the CIPAC Water Sector Cybersecurity Strategy Workgroup in its 2015 
Final Report & Recommendations. 

IV. RESILIENCE PRACTICES 


The following highlights primary practices implemented at the utility and sector levels, along with 
specific challenges in fully realizing resilience. The practices are organized into categories consistent 
with components of the NIPP 2013 risk-management framework and core tenets: set goals and 
objectives, understand dependencies and interdependencies, assess and analyze risk, share 
information, and implement risk-management activities. 

SET GOALS AND OBJECTIVES 

The Water Sector is proactive in identifying and prioritizing goals to managing risks across the 
sector. Current goals and priorities driving the sector are derived from the 2013 Roadmap to a 
Secure & Resilient Water Sector (2013 Roadmap) and the 2015 SSP. Commonalities across the 
documents include an increased focus on outreach and awareness campaigns; preparedness, 
recovery, and resilience strategies; and cybersecurity concepts and capabilities. 

The 2013 Roadmap priorities are: 

• Advance the development of sector-specific cybersecurity resources. 

• Raise awareness of the Water Sector as lifeline sector and recognize the priority status of its 
needs and capabilities. 

Support the development and deployment of tools, training, and other assistance to 
enhance preparedness and resilience. 

They are used by EPA and its public-private partnerships in the sector to focus on activities in a two 
to five year timeframe that can together strengthen the sector's ability to plan for effective 
response and recovery, maintain resilience during a calamitous event, and garner support for both 
disaster and risk-mitigation cost recovery. 129 The 2015 SSP's four strategic goals and 13 objectives 
are outlined in Exhibit G-6. They are used by the sector to develop, implement, and measure 


129 CIPAC Water Sector Strategic Priorities Working Group, Roadmap to a Secure and Resilient Water Sector, 
2013. 
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progress of protection and resilience activities designed to prevent, detect, respond to, and recover 
from all hazards. 130 

Exhibit G-6. Water Sector Goals and Objectives 131 


Goal I: Sustain protection of public health and the environment. The Nation relies on 
sustained availability of safe drinking water and on treatment of wastewater to maintain public health 
and environmental protection. To protect public and environmental health better, the Water Sector 
works to ensure the continuity of both drinking water and wastewater services. 


Objective 1 

Encourage integration of both physical and cybersecurity concepts into daily business 
operations at utilities to foster a security culture. 

Objective 2 

Evaluate and develop surveillance, monitoring, warning, and response capabilities to 
recognize and address all-hazards risks at water systems that affect public health and 
economic viability. 

Objective 3 

Develop a nationwide laboratory network for water quality protection that integrates 
Federal and State laboratory resources and uses standardized diagnostic protocols and 
procedures, or develop a supporting laboratory network capable of analyzing threats to 
water quality. 


Goal 2. Recognize and reduce risk. With an improved understanding of the vulnerabilities, 
threats, and consequences, owners and operators of utilities can continue to thoroughly examine and 
implement risk-based approaches to protect, detect, respond to, and recover from all hazards better. 


Objective 1 

Improve identification of vulnerabilities based on knowledge and best available 
information, with the intent of increasing the sector's overall protection posture. 

Objective 2 

Improve identification of potential threats through knowledge base and 
communications—with the intent of increasing overall protection posture of the sector. 

Objective 3 

Identify and refine public health and economic impact consequences of manmade or 
natural incidents to improve utility risk assessments and enhance the sector's overall 
protection posture. 


130 EPA, 2015 SSP, 2016. 

131 EPA, 2015 SSP, 2016, Table 2, pp. 17-18 
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Goal 3. Maintain a resilient infrastructure. The Water Sector will investigate how to optimize 
continuity of operations to ensure the economic vitality of communities and the utilities that serve 
them. Response and recovery from an incident in the sector will be crucial to maintaining public health 
and confidence. 


Objective 1 

Emphasize continuity of drinking water and wastewater services as it pertains to utility 
emergency preparedness, response, and recovery planning. 

Objective 2 

Explore and expand implementation of mutual aid agreements/compacts in the Water 
Sector by encouraging utilities to join their State WARN. The sector has significantly 
enhanced its resilience through agreements among utilities and States; increasing the 
number and scope of these will further enhance resilience. 

Objective 3 

Identify and implement key response and recovery strategies. Response and recovery 
from an incident in the sector will be crucial to maintaining public health and 
confidence. 

Objective 4 

Increase understanding of how the Sector is interdependent with other critical 
infrastructure sectors. Sectors such as Healthcare and Public Health and Emergency 
Services are largely dependent on the Water Sector for their continuity of operations, 
while the Water Sector is dependent on sectors such as Chemical or Energy for 
continuity of its operations. 


Goal 4. Increase communication, outreach, and public confidence. Safe drinking water and 
water quality are fundamental to everyday life. An incident in the Water Sector could have significant 
impacts on public confidence. Fostering and enhancing the relationships between utilities, 
government, and the public can mitigate negative perceptions in the face of an incident. 


Objective 1 

Communicate with the public about the level of protection and resilience in the sector 
and provide outreach to ensure the public's ability to be prepared for and respond to a 
natural disaster or manmade incident. 

Objective 2 

Enhance communication and coordination among utilities and Federal, State, and local 
officials and agencies to provide information about threats by utilizing WaterlSAC and 
other information-sharing networks. 

Objective 3 

Improve relationships among all Water Sector partners through a strong public-private 
partnership characterized by trusted relationships. 


UNDERSTAND DEPENDENCIES AND INTERDEPENDENCIES 

The level of resilience in the Water Sector is of fundamental importance to the Nation, because the 
sector is a lifeline sector. The lives and well-being of Americans and the efficient functioning of the 
U.S. economy depend on a continued and dependable supply of water and wastewater services. 
This fundamental importance can easily be seen in terms of the critical interdependencies between 
the Water Sector and other sectors. A more specific listing of how these sectors depend on each 
other is provided in the 2015 SSP. 
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Dependencies and interdependencies that exist between the Water Sector and other critical sectors 
have been identified and extensively documented in after-action reports on the cascading effects of 
past major events. The 2013 WARN Superstorm Sandy After-Action Report serves as one of the most 
influential after-action reports for the sector, because it identified key actions related to 
dependencies that could reduce consequences and increase resilience in the Water Sector in the 
future. These recommended actions were organized into several categories: Interstate Mutual Aid & 
Assistance, Elevating the Priority Status of Water Infrastructure, Energy and Water Nexus in 
Disasters, Site Access, Coordination, Situational Awareness, and Communications. 132 

Interdependencies of the Water Sector with the Energy and Healthcare and Public Health Sectors 
are of most prominence during recent major events. For example, in collaboration with the 
Healthcare and Public Health Sector, the Water Sector has helped develop plans, protocols, and 
processes to assist the dependent sector to prepare for emergencies. Nonetheless, and as illustrated 
by the lack of clear understanding of all the ramifications of the Energy-Water nexus, there remains 
a critical need to further develop the methodologies to collect and analyze relevant data to be 
better able to manage these types of complex interdependencies. An excellent example of the 
specificity required to achieve this level of coordinated response is the sector's efforts to reach out 
and assist healthcare facilities with their emergency planning in the event of an emergency 
impacting their water supply. The following sections describe these interdependencies in greater 
detail. 

Energy-Water Nexus 133 

The Energy and Water Sectors are closely linked with each other. Energy requires water in large 
quantities for mining, fuel production, hydropower, and power plant cooling. Water needs energy 
for pumping, treatment, and distribution of water and for collection, treatment, and discharge of 
wastewater. Estimates of the Nation's electricity contributing to moving and treating water and 
wastewater by public and private entities range between 4 and 13 percent, depending on how it is 
calculated. In some parts of the country, such as California, those estimates run as high as 19 
percent. 

As similar situation exists with the Energy Sector's need for water. Agriculture dominates U.S. water 
consumption at 71 percent; however, the Energy Sector (including biofuels, thermoelectric, and fuel 
production) is the second-largest consumer at 14 percent, while domestic and public uses are third 
at 7 percent. More than 80 percent of U.S. electricity is generated at thermoelectric facilities that 
depend on cooling water; these facilities withdraw 143 billion gallons of freshwater per day. In 2005, 
thermoelectric cooling represented 41 percent of water withdrawn nationally, and 6 percent of 
water consumed nationally. Water availability issues—such as regional drought, low-flow, or intense 
competition for water—are critical for hydroelectric and thermoelectric generation. However, the 
Energy Sector's need for water varies widely across the sector. In some cases, such as fuel 
production, the byproduct is wastewater. Wastewater (often saline) brought to the surface by oil 


132 AWWA, WARN: Superstorm Sandy After-Action Report, 2013. 

133 Copeland, Energy-Water Nexus: The Water Sector's Energy Use, 2014; and Carter, Energy-Water Nexus: The 
Energy Sector's Water Use, 2013. 
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and gas wells represent the largest byproduct of fuel production. Approximately 2.3 billion gallons 
are produced daily from onshore oil and gas wells in the United States. 

A Congressional Research Service (CRS) study noted several areas requiring additional research 
before the energy-water nexus could be more fully understood. The research areas included: 134 

Data that could help decision-makers and users fill what is now an incomplete picture of 
energy needs for water uses are lacking. This is apparent across sectors and also within 
individual sectors. Data that exist are scattered and often are not available at a scale needed 
by decision-makers. 

• More integrated research is needed on water and energy operations. Standards for data 
collection, coordination, and quality control are lacking. 

• Research is needed on advanced technologies that save energy and save water, and 
partnerships between government and the private sector that move research and 
development from bench-scale to implementation are needed. 

Better understanding is needed of linkages between energy, water, land, and agriculture 
and risks of climate change and extreme weather events on water availability and energy 
supply. 

Policies and approaches are needed to encourage the water and energy sectors to move 
toward integrated resource management. 

Analysis is needed of incentives, disincentives, and lack of incentives to investing in cost- 
effective energy or water efficiency measures. One area of interest is regulatory barriers to 
co-implementation of efficiency programs in the water and energy sectors. 

More education and outreach to all types of water users, the general public, and public 
officials are needed on the water-energy nexus and how improving efficiency involves the 
reciprocity of saving energy and saving water. 

To address these and other issues surrounding the water-energy nexus, the U.S. Department of 
Energy (DOE) proposed a new energy-water nexus crosscutting activity for fiscal year (FY) 2016 that 
would analyze the relationships between energy and water use and conduct research on water and 
energy systems. DOE justified its new activity on the grounds that energy is a major user of the 
Nation's water and that extraction, distribution, and treatment of water requires large amounts of 
energy. Components of DOE participating in the crosscutting activity include several DOE offices: 
Energy Policy and Systems Analysis, International Affairs, Energy Efficiency and Renewable Energy, 
Fossil Energy, Indian Energy Policy and Programs, and Science. 135 

Water Supply and Healthcare Facilities 

The energy-water nexus illustrates the close interdependencies between these two sectors. An 
example of a critical infrastructure sector dependency on water is the need for hospitals and 
healthcare facilities to access a reliable source of water during emergencies. Without water, the 


134 Ibid. 

135 Holt, Energy and Water Development: FY2016 Appropriations, 2015. 


NIAC Water Sector Resilience Final Report and Recommendations 


155 



facilities will shut down, and the lives of individuals needing their care may be in jeopardy. To 
address this life-critical issue, the CDC and AWWA collaborated in the development of the 
Emergency Water Supply Planning for Hospitals and Healthcare Facilities and the Drinking Water 
Advisory Communication Toolbox. Both of these documents reflect Water Sector resilience efforts in 
conjunction with the needs of a dependent sector. 

The Emergency Water Supply Planning for Hospitals and Healthcare Facilities report provides a four- 
step process and detailed guide for the development of an Emergency Water Supply Plan (EWSP): 136 

1. Assemble the appropriate EWSP Team and the necessary background documents for your 
facility; 

2. Understand your water usage by performing a water use audit; 

3. Analyze your emergency water supply alternatives; and 

4. Develop and exercise the EWSP. 

The Drinking Water Advisory Communication Toolbox provides a protocol and practical toolbox for 
communicating with stakeholders and the public about water advisories. It focuses on water 
systems and addresses the range of situations that generate drinking water advisories. 137 The 
Toolbox is based on more than 500 documents, protocols, regulations, and other resources related 
to the issuing of drinking water advisories, as well as nearly 100 interviews conducted with water 
systems, primacy agencies, and local public health departments in the United States and Canada. 
The toolbox includes instructions on how to prepare before an event, what to do during an event, 
templates and tools to use, and recommendations for follow-up actions and assessments after an 
event. The purpose of the toolbox is to enable water systems to communicate effectively with 
partners and the public in order to protect public health. 

ASSESS AND ANALYZE RISK 

The vulnerability of Water Sector systems, coupled with their essential life supporting services, 
necessitates that sector owners and operators (publicly and privately owned) pay exceptionally 
close attention to risk management in the sector. Historically, water and wastewater utilities have 
incorporated protection and emergency preparedness initiatives into their operating protocols, with 
a traditional goal of continuously improving their infrastructure protection, security, dependability, 
and resilience. The assessment of risk to individual utilities and their specific infrastructure is 
conducted primarily by the utilities themselves. However, there are challenges in providing 
vulnerability assessments to those outside the utility. Obstacles to the sharing of this kind of 
detailed vulnerability information has limited the Federal Government's ability to compile on a 
national level an accurate and complete assessment of the sector's security and resilience status. 

Drinking water and wastewater utilities are encouraged to conduct or update risk assessments as 
well as to prepare or revise Emergency Response Plans (ERP) on a regular basis. EPA's Vulnerability 
Self-Assessment Tool (VSAT) provides Water Sector utility owners and operators with qualified and 


136 CDC and AWWA, Emergency Water Supply Planning Guide for Hospitals and Health Care Facilities, 2012. 

137 CDC, and et al., Drinking Water Advisory Communication Toolbox, 2013. 
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quantified risk assessment processes to measure risk at the asset and system level; prioritize utility 
investments and efforts to mitigate risk; and track utility risk-management performance and 
investment over time. VSAT uses consistent vulnerability, consequence, and threat information 
within the Risk Analysis and Management for Critical Asset Protection framework, also known as 
RAMCAP. EPA's Water Health and Economic Analysis Tool (WHEAT) is a generalized (threat-neutral) 
consequence analysis tool, designed to assist drinking water and wastewater utility owners and 
operators in quantifying public health consequences, utility-level financial consequences, direct and 
indirect regional economic consequences, and the downstream impacts of an adverse event that 
pose risks to the Water Sector. The WHEAT tool includes modules for drinking water and 
wastewater systems. 

Examples of regional and local resilience measures, aimed at managing assessed risk, from the Los 
Angeles area include: 

The Metropolitan Water District of Southern California (MWD) assists local southern 
California communities to develop local sources of water and utilize groundwater banking 
and transfers. MWD also promotes and invests in conservation and water use efficiency 
programs as a way to help the region adapt to current and anticipated shortages of 
imported water from Northern California and the Colorado River. 138 

Facing aging infrastructure of its system, the Los Angeles Department of Water and Power 
(LADWP) developed a Capital Improvement Program with a 10-year horizon to maintain and 
replace existing components of the water system, as well as substantial updates or 
construction of new facilities. 139 

• LADWP's water conservation programs includes providing incentives for installation of more 
than 1.8 million water-saving showerheads, more than 1.27 million water-efficient toilets, 
and more than 80,000 high efficiency clothes washers. Water saving from the more efficient 
toilets themselves save the City more than 14 billion gallons of water each year. As well as 
instituting a "Cash in Your Lawn" program, whereby residents of the City have replaced over 
15 million square feet of traditional grass with low-water-using "California Friendly 
landscaping," saving 540 million gallons of water per year. 140 

The City of Los Angeles adopted the "One Water LA 2040 Plan" (One Water LA). Coordinated 
by a multiagency implementation team, One Water LA is a collaborative approach to 
develop an integrated framework for managing the City's watersheds, water resources, and 
water facilities in an environmentally, economically, and socially beneficial manner. 141 

SHARE INFORMATION 

Information sharing plays an essential role in the security and resilience of the Water Sector. The 
sector leverages the resources and capabilities of four primary information-sharing mechanisms to 


138 Metropolitan Water District of Southern California, Integrated Water Resources Plan, 2016. 

139 LADWP, "Water Infrastructure Plan," 2015. 

140 Ibid. 

141 City of LA, "One Water LA." 
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support resilience across the sector: the Water Information Sharing and Analysis Center 
(WaterlSAC), Water/Wastewater Agency Response Network (WARN), and trade associations. 

Water Information Sharing and Analysis Center (WaterlSAC) 

Established as a nonprofit organization in 2001, the WaterlSAC is the primary information-sharing 
and operational arm of the Water Sector. Through a secure Webportal, twice-weekly e-newsletters, 
alerts, and Webinars, the WaterlSAC delivers physical and cyber threat information; guidance on risk 
management, mitigation and resilience; contaminant databases; and other information. Members 
include hundreds of utilities serving more than 200 million people in the United States, as well as 
Federal, State, and local agencies and consulting firms. 142 The WaterlSAC is supported by fees 
charged to its users. 

WaterlSAC Pro-members receive a wide range of services, including a vast library of 
sensitive threat information, best practices, articles, exercise guides, vulnerability 
assessments, and other resources on security and emergency management; contaminant 
databases with information on health effects, treatment and lab methods; a bi-annual 
Water Sector threat analysis; urgent physical and cyber threat alerts; and free Webcasts on 
current water security and emergency response topics. 

BASIC members are granted access to a library of open-source information about security 
and emergency response and threat alerts. 143 

Water/Wastewater Agency Response Network (WARN) 

WARN is an intrastate network of utilities helping utilities to respond to and recover from 
emergencies by sharing resources with each other. WARN enables participating agencies to 
maintain contact with one another for emergency purposes, providing expedited access to 
specialized resources, and facilitating training on resource exchange. WARNs are volunteer-based, 
utility-to-utility networks that prepare for disasters, and then help member utilities respond and 
recover more quickly by getting the specialized utility resources (e.g., equipment and personnel) 
whenever and wherever needed. AWWA hosts a WARN Webpage that provides contact information 
for WARN representatives around the Nation, as well as links to situational reports prepared by 
WARN during emergencies, such as Hurricane/Superstorm Sandy. 144 In 2014, there were a total of 
50 WARNs in the United States and 2 WARNs in Canada. 

Water Sector Associations 

Water Sector associations play a vital role in the information-sharing aspects of resilience. Some of 
AWWA's efforts in this have already been mentioned: the 2013 Roadmap and support of the WARN 
Website. A few further examples of association activities which seek to enhance sector resilience 
include: 

• The Association of State Drinking Water Administrators (ASDWA) in 2014 released a report 
documenting a yearly shortfall of at least $230 million between the resources available in 


142 National Council of ISACs, "Join Your Sector's Information Sharing and Analysis Center," 2015. 

143 WaterlSAC, "About Water ISAC." 

144 AWWA, "Water/Wastewater Agency Response Network." 
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States (from all sources - both Federal and State) and those needed by States to administer 
minimum required programs. 145 

The Association of Metropolitan Water Agencies (AMWA) has a program to assist publicly 
owned utilities to adapt to climate change. One example is its monthly Sustainability and 
Security Report. 146 

The National Association of Clean Water Agencies (NACWA) is active in next generation 
Water Sector issues, such as the energy-water nexus, green infrastructure, watershed-based 
solutions, and water resources utility of the future. 147 

The National Association of Water Companies (NAWC) has many programs supporting public 
and private investment in water infrastructure. Its State-by-State summary of water 
investments is a useful tool for both advocates as well as policy makers. 148 

IMPLEMENT RISK MANAGEMENT ACTIVITIES 

As highlighted in the 2015 SSP sector partners develop and disseminate guides, tools, training, and 
exercises aimed at managing risk. 149 Several of these practices are organized below according to 
NIAC's definition of resilience: robustness in preparing for an event; resourcefulness through 
training, exercises, and drills; rapid recovery; and adaptability through incorporating lessons 
learned. Additional examples of resilience activities in the Water Sector can be found in Appendix I. 
Collaborative Tools and Practices. 

Robustness in Preparing for an Event 

Published Weather & Hydrologic Forecasting for Water Utility Incident Preparedness and 
Response to provide hazardous weather and forecasting resources for utility awareness and 
preparedness 

Developed the interactive Flood Resilience: A Basic Guide for Water and Wastewater 
Utilities to help utilities know their flooding threat and identify practical mitigation options 
to protect critical assets 

Published 10 Basic Cybersecurity Measures to Reduce Exploitable Weaknesses and Attacks 
(WaterlSAC) 

Developing a method to coordinate cyber and physical risk-assessment tools to enhance 
management decision-making 

Updating the All-Hazards Conseguence Management Plan to create a better understanding 
of current threats and vulnerabilities and strategies to reduce the impacts of an emergency 
event 


145 ASDWA, "Press Release: Insufficient Resources for State Drinking Water Programs," 2014. 

146 AMWA, "Sustainability and Security Report," 2016. 

147 NACWA, "Issues: Utility of the Future," 2016. 

148 NAWC, State Data Sheet 2013, 2013. 

149 EPA, 2015 SSP, 2016. 
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Developed Business Continuity Planning for Water Utilities: Guidance Document (Water 
Research Foundation, AWWA, and EPA) 

Enhancing engagement with utilities during smaller emergencies and planned maintenance 
to assess emergency response plans 

Harnessing existing tools and guidance to develop an overarching tool/resource that defines 
key actions and procedures to help utilities enhance their preparedness and resilience 

Developing incentives—through grants, insurance, standards, and certification—to increase 
investment in Water Sector infrastructure 

Periodically assessing available resources, identifying current needs and gaps, and improving 
existing resources or develop new ones 

Resourcefulness through Training, Exercises, and Drills 

Conducted training workshops in EPA Regions 2 and 5 to educate drinking water utilities on 
the design and implementation of contamination warning systems, such as those 
implemented under the Water Security Initiative 

Developed How to Develop a Multi-Year Training and Exercise Plan to assist utilities in 
creating multiyear plans that can lead to increased emergency preparedness 

Developed the “Don't Get Soaked" video for utility managers, board members, and 
elected/appointed officials to help them understand the benefits of investing in 
preparedness, prevention, and mitigation activities 

Conducting State and local exercises, tabletop exercises, and workshops that improve 
understanding of Water Sector interdependencies, sector criticality, and impacts of loss of 
service during a disaster 

Developing and implementing an education and awareness campaign that helps utilities to 
communicate the importance of the Water Sector in emergency planning and to describe 
the costs and benefits of risk-reduction investments to States and public commissions using 
sector risk assessment and consequence analysis tools 

Developing and implementing public messaging to gain consumer support in addition to 
Federal, State, and local support for pre-disaster risk-reduction and resilience activities 

Rapid Recovery 

Developed "Federal Funding for Utilities - Water/Wastewater - in National Disasters" (Fed 
FUNDS) tool to provide tailored information to utilities about applicable Federal disaster 
funding programs 

Published a report documenting the findings from an EPA evaluation of commercially 
available water quality event detection systems 

Determining the applicability of FEMA assistance criteria to address Water Sector needs and 
ensure the criteria are clear and well understood 
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Integrating Water Sector considerations into all-hazards preparedness and response tools 
designed to support wide-area urban contamination incident response 

Developed the “How Can Water Utilities Obtain Critical Assets to Support Decontamination 
Activities" fact sheet 

Integrating Water Sector considerations into emergency response planning to ease access 
and credentialing issues for water utility personnel during an event 

Adaptability through Incorporating Lessons Learned 

Performing after-action analyses after large events that highlight economic implications for 
the Water Sector 

Demonstrating the capabilities of existing tools and developing case studies to 
communicate their success 

Leveraging tools and best practices from interdependent sectors to understand their 
potential application to the Water Sector 

Developing Federal incentives for State drinking water programs and emergency 
management programs to support hazard mitigation investments 

Developing a tool consistent with the AWWA J100-10 standard to help utilities update all¬ 
hazards risk assessments, and then leverage them to update emergency response and risk- 
management plans; perform after-action analyses; and incorporate lessons learned 
following an event 

Examining climate change adaptation strategies to identify "no regret" measures that offer 
multiple types of benefits 
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APPENDIX H. 

THE FLINT WATER CRISIS 


Flint, Michigan—a city of about 99,000 people—lost access to safe, reliable drinking water due to a 
confluence of factors—"government failure, intransigence, unpreparedness, delay, inaction, and 
environmental injustice," according to the Flint Water Advisory Task Force Final Report. 150 The Flint 
water crisis underscores the importance of water to daily life, the impact on people who are unable 
to access safe drinking water, and the long-lasting consequences such contamination can have on 
residents, particularly children and other vulnerable members of the community. 

For this study, the NIAC was tasked with assessing the security and resilience of water 
infrastructure, uncovering key resilience issues with that infrastructure, and identifying potential 
opportunities to address issues. The Flint water crisis demonstrates the underlying vulnerability of 
systems that are not properly maintained and managed. 

Additional information is likely to emerge as the causes and consequences of the crisis are 
investigated. As of May 2016, there are multiple ongoing investigations including congressional 
hearings, the U.S. Environmental Protection Agency's 
(EPA) Flint Safe Drinking Water Task Force, and a 
multiagency investigation through the U.S. Attorney's 
Office with the Federal Bureau of Investigation. In May, 
the Michigan State Attorney General charged two State 
regulators and a city employee in connection with the 
incident. 151 

This appendix provides a brief overview of the facts of 
the incident, as they are known today; underlying 
deficiencies that contribute to infrastructure failures; 
and how the NIAC's recommendations, if implemented, 
could help prevent future situations like that in Flint. 

I. INCIDENT OVERVIEW 


® • The bad news is that this should 
not have happened in the first place. 
And even though the scope of the 
response looks sort of like the efforts 
we’re used to seeing after a natural 
disaster, that’s not what this was.This 
was a manmade disaster.This was 
avoidable.This was preventable.” 

President Barack Obama, May 4,2016, 
Flint, Michigan 


The Flint crisis started in April 2014 when the city switched its water source from Lake Huron 
(treated by Detroit Water and Sewerage Department) to the Flint River (treated by the Flint Water 
Treatment Plant). The Michigan governor and President of the United States declared states of 
emergency to free up State and Federal resources to help in response. 152 Cases of bottled water and 
filters were distributed to residents and lawmakers have called for additional Federal funding to be 
provided to aid Flint and other cities with similar situations to replace the lead pipes and provide 
resources to support the people affected by lead contamination. 


150 Flint Advisory Task Force, Final Report, 2016. 

151 Flouseholder and White, "3 Officials charged in Flint water crisis; more predicted," 2016. 

152 The White Flouse, "President Obama Signs Michigan Emergency Declaration," 2016. 
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The Flint water crisis arose from contamination of the drinking water serving Flint, Michigan, when 
the water source was switched from Lake Huron water to more corrosive the Flint River water. 153 
Required corrosion control treatment was never put in place when the switch was implemented, 
causing the untreated water to corrode the lead feeder pipes that connect homes to the 
underground water main, causing lead to leach into the drinking water. 154 After the contamination 
was brought to light, Flint re-connected to the Detroit Water and Sewerage Department in October 
2015. 


II. UNDERLYING DEFICIENCES 


Although a rare incident, the features of the Flint water crisis are not unique. Underlying 
deficiencies such as planning and investment constraints, poor management, and insufficient 
government coordination and collaboration led to resilience failures. In the process, public 
confidence in the water supply erodes and public health and the environment is damaged. The 
underlying deficiencies revealed in the Flint water crisis are present throughout this report on Water 
Sector resilience. The information below describes these themes in relation to the Flint water crisis. 


CONDITION OF INFRASTRUCTURE 

America's water infrastructure is aging and is in dire need of reinvestment. Aging infrastructure is 
one of the main contributors to lead in the water supply. 155 In 1986, Congress banned new lead 
pipes—"use of any pipe, any pipe or plumbing fitting or fixture, any solder, or any flux, after June 
1986, in the installation or repair of (i) any public water system; or (ii) any plumbing in a residential 
or nonresidential facility providing water for human consumption, that is not lead free." 156 However, 
some U.S. water distribution systems still contain lead pipes and fixtures (typically, those built 
before the 1980s) and some major cities still have 100 percent lead piping bring water from the 
water utility to the homes and businesses. 157 American Water Works Association (AWWA) estimates 
there are about 6.5 million lead service lines in the United States, while EPA estimates the number is 
closer to 10 million. 158 Comprehensive reinvestment in public drinking water and wastewater 
systems—not just for lead pipe replacement—is necessary for safe, clean, and resilience water 
services. 


PLANNING AND INVESTMENT CONSTRAINTS 

Declining populations and increased conservation of water can lead to a decline in revenue sources. 
The water system in Flint was built for a city of 200,000 people; however, today's population is half 
of that. As populations decline, the remaining people must share the full cost for water services and 
investment, while municipalities must make ends meet with a smaller tax base. 159 Infrastructure 


153 Adams, "Closing the valve on history: Flint cuts water flow from Detroit after nearly 50 years," 2014. 

154 Edwards, "Test Update: Flint River water 19X more corrosive," 2015; and Office of the Auditor General, 
Questions and Answers to Senator Ananich, 2015. 

155 EPA, "Basic Information about Lead in Drinking Water." 

156 EPA, "Section 1417 of the Safe Drinking Water Act," 2015. 

157 EPA, "Basic Information about Lead in Drinking Water." 

158 Householder and White, "3 Officials charged in Flint water crisis; more predicted," 2016. 

159 Semeuls, "A Tale of Two Water Systems," 2016. 
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cannot be easily downsized to meet the needs of a smaller population and acceptable level of 
services cannot be reduced to counteract the population decline. 160 

The residents of Flint also have some of the highest water rates in the nation, averaging $76 per 
month. Michigan law restricts city governments' ability to raise property and income taxes. As a 
result, the city government relied on its water and sewer revenues to counteract a reduced tax base 
and reductions in State funding. 161 As a result, the Flint residents were having to pay more to 
maintain operations, the funds that would have been available for infrastructure improvements 
were being diverted, and investment decisions were not being determined with long-term resilience 
in mind. 


GOVERNMENT COORDINATION AND COLLABORATION 

The Flint Water Advisory Task Force's Final Report highlights the government failures that 
precipitated and lengthened the water crisis: 162 

• The Michigan Department of Environmental Quality (MDEQ), which has primacy authority, 
failed to effectively enforce drinking water regulations, and dismissed efforts to bring issues 
of unsafe water, lead contamination, and increased cases of Legionnaires' disease to light. 

The Michigan Department of Health and Human Services (MDHHS) failed to adequately and 
promptly act to protect public health. 

With the City of Flint under State-appointed emergency management, the Flint Water 
Department rushed into full-time operation of the Flint Treatment Plant without applying 
corrosion control needed to use the Flint River. 

EPA delayed enforcement of the Safe Drinking Water Act (SDWA) and Lead and Copper Rule 
(LCR). 

The Governor's Office failed to reverse poor decisions made by MDEQ and emergency 
managers despite senior staff members raising concerns and suggesting intervention. 

III. WATER RESILIENCE RECOMMENDATIONS 
APPLIED TO FLINT 


The Flint water crisis reinforces the critical role that water plays in our lives and the devastating 
impact on communities when water services are compromised. This report makes several 
recommendations that if applied would improve resilience within the Water Sector, and help water 
and wastewater systems avoid situations like Flint. 

The NIAC Resilience Framework encourages those who manage critical infrastructure create robust 
systems that can absorb the shock of an incident and continue to provide clean safe water; 


160 Hoornbeek and Schwarz, "Sustainable Infrastructure in Shrinking Cities," 2009. 

161 Snider, "Flint's other water crisis: Money," Politico, March 7, 2016, 

162 Flint Advisory Task Force, Final Report, 2016. 
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resourceful in managing an incident to continue to provide services; quickly restore compromised 
service and return to normal; and adapt to a changing environment and risks. 

The NIAC's recommendations call on the Federal Government, its public and private sector partners, 
and water utilities to: 

Analyze and map complex risks. The NIAC recommends that the Federal Government work 
with the Water Sector to identify tools, guidance, and mitigation measures and increase 
distribution across the sector. By clearly understanding risks, and having access to tools, 
models, checklists, and other resources, decision-makers could have a better understanding 
of the impacts and consequences of actions, such as switching water sources. 

Fortify response and recovery. This recommendation calls on the Federal Government to 
formalize and improve response and recovery capabilities at all levels of the Water Sector. 
Flint was a manmade disaster, but the response is similar to what happens following a 
natural disaster (e.g., emergency declaration, Federal funding assistance). But in Flint, once 
the problem was identified, the response was delayed. Creating a more formal response and 
recovery process, including reinforcing effective mutual aid models such as WARN, can 
provide water utilities and communities with the skills, information, and resources they 
need to quickly respond following an incident (whether it's a natural or manmade disaster). 

Increase Federal funding, investment, and incentives to improve water infrastructure 
resilience. Water utilities must often balance day-to-day operations with long-term 
infrastructure investments. For Flint, and communities in similar situations, access to 
innovative financing options can help utilities make these needed investments. The NIAC 
also recommends the creation of a Federal financial assistance program to reduce the 
burden on low-income communities from water rate increases. 

Increase technical and financial resources available to the Water Sector. If utilities have 
access to technical resources, such as local universities, workforce training, tools and life- 
cycle assessment models, they will have the capabilities to prepare and respond to existing 
and emerging risks, and to improve resilience. 

Strengthen Federal leadership coordination, and support. As illustrated in Flint, there were 
failures of government at the Federal, State, and local level that have a role in oversight of 
water services. Better coordination and communication across all levels of government is 
crucial for maintaining safe and effective water services. This coordination starts at the 
Federal level. 
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APPENDIX I. 

COLLABORATIVE TOOLS AND PRACTICES 


Enhanced collaboration between Water Sector partners has accelerated progress in attaining secure 
and resilient drinking water and wastewater infrastructure. The success stories summarized below 
represent the benefits of greater collaboration from improved sharing of resources; expanded use 
of new tools, knowledge, and training; and the improved characterization of emerging threats such 
as cyber intrusions and extreme-weather events. 

I. SHARING RESOURCES 


The Emergency Management Assistance Compact (EMAC) is an interstate mutual aid agreement 
that facilitates the sharing of assistance among States during emergency events, including natural 
and manmade disasters. Ratified by the U.S. Congress in 1996, EMAC is the most widely adopted 
mutual aid arrangement in the United States; it has been adopted by all 50 States, the District of 
Columbia, Puerto Rico, Guam, and the U.S. Virgin Islands. It provides a structured approach through 
which a State can request aid—including personnel, services, equipment, and supplies—from other 
States during an emergency. EMAC establishes responsibility for reimbursement between States, 
and also addresses liability, compensation, and licensing issues for personnel deployed pursuant to 
an EMAC request. 163 

The Water and Wastewater Agency Response Network (WARN) is a network of utilities helping 
other utilities to respond to and recover from emergencies. Through this network, 
water/wastewater utilities that have sustained damages from natural or manmade events can 
obtain emergency assistance from other water/wastewater utilities. Assistance includes personnel, 
equipment, materials, and other associated services as necessary. Formalizing the existing capability 
to provide mutual aid and assistance provides the sector with a degree of resilience against natural 
or manmade disasters to ensure continuity of service to customers. 164 

To expedite communication of Water Sector resource needs during an incident, the American Water 
Works Association (AWWA) developed the Water & Wastewater Mutual Aid & Assistance Resource 
Typing Manual, which uses EMAC for interstate mutual aid deployments. This manual was 
developed with extensive input from water utility owners/operators and is based on the 
team/mission approach to incident response for intra- and interstate mutual aid and assistance. 165 

The Virginia Pooled Financing Program, established in 2003, provides financing to local 
governments for essential products. Pooled loan programs are a cost-effective mechanism for 
borrowers to participate in a larger transaction to access capital markets. Since the program's 
inception, more than 100 local governments in Virginia have utilized the program to finance/re¬ 
finance over $2 billion in infrastructure projects, including water projects. 166 


163 EMAC, "Homepage." 

164 AWWA, "WARN." 

165 AWWA, Water & Wastewater Mutual Aid & Assistance Resource Typing Manual, 2008. 

166 Virginia Resources Authority, "Virginia Pooled Financing Program." 
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II. ACCESSING TOOLS, KNOWLEDGE, AND 
TRAINING 


The AWWA G430-14: Security Practices for Operations and Management guide can help utilities to 
develop a protective security program that promotes the protection of employee safety, public 
health, public safety, and public confidence. The guide defines standard, minimum requirements for 
a protective security program and builds on the long-standing practice among utilities of utilizing a 
multiple barrier approach for the protection of public health and safety. The requirements outlined 
in the standard are designed to support a protective utility-specific security program that results in 
consistent and measurable outcomes to address the full spectrum of risk management from 
organizational commitment, physical and cybersecurity, and emergency preparedness. The standard 
received SAFETY Act designation from the U.S. Department of Homeland Security (DHS). 167 

The AWWA G440-11 Emergency Preparedness Practices guide is one of several in a Utility 
Management series designed to cover the principal activities of a typical water and/or wastewater 
utility. It defines the minimum requirements for emergency preparedness for a water or wastewater 
utility and expands upon the requirements outlined in the AWWA G430 guides. Minimum practices 
include the development of an emergency response plan (hazard evaluation, hazard mitigation, 
response planning, and mutual aid agreements), the evaluation of the emergency response plan 
through exercises, and the revision of the emergency response plan after exercises. 168 

The Business Continuity Plans for Water Utilities: Guidance Document guide provides sector- 
specific guidance—jointly developed by the Water Environment Research Foundation (WERF), 
AWWA, and the U.S. Environmental Protection Agency (EPA) on behalf of the Water Sector 
Coordinating Council (Water SCC)—for utilities to develop a business continuity plan, including a 
Disaster Response Plan. 169 

The CIPAC Water Sector Cybersecurity Strategy Workgroup: Final Report and Recommendations 

recommends training and outreach approaches to promote the use of the NIST Framework for 
Improving Critical Infrastructure Cybersecurity; 170 identifies gaps in available guidance, tools, and 
resources for addressing this framework; and identifies measures of success that can be used to 
indicate the extent to which the framework is being used by the Water Sector. It also provides 
recommendations to achieve each of these areas. 171 

A number of agencies and organizations have developed stormwater and Green Infrastructure 
Calculating Tools to assist design professionals in stormwater management and green infrastructure 
planning, costing, and comparison of various best management practices. A compiled list of 
calculators currently available from EPA, Center for Neighborhood Technologies, Sustainable 


167 AWWA, A l/l/l/l/A G430-14: Security Practices for Operations and Management, 2015. 

168 AWWA, A WWA G440-11 Emergency Preparedness Practices, 2011. 

169 WERF, EPA, and AWWA, Business Continuity Planning for Water Utilities, 2013. 

170 NIST, Framework for Improving Critical Infrastructure Cybersecurity, 2014. 

171 CIPAC Water Sector Cybersecurity Strategy Workgroup, Final Report and Recommendations, 2015. 
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Technologies Evaluation Program, WERF, and State and municipal governments is available online 
from a manufacturer of interlocking concrete paver materials. 172 

Information Sharing and Analysis Centers (ISACs) help critical infrastructure owners and operators 
protect their facilities, personnel, and customers from cyber and physical security threats and other 
hazards. ISACs reach deep into their sectors, communicating critical information far and wide and 
maintaining sector-wide situational awareness. ISACs collect, analyze, and disseminate actionable 
threat information to their members and provide members with tools to mitigate risks and enhance 
resilience. 173 WaterlSAC, a nonprofit organization established in 2001, is the information sharing 
and operational arm for water and wastewater utilities. The organization helps members strengthen 
their cyber and physical security, recover from natural and manmade disasters and improve overall 
preparedness and resilience. Through a secure Webportal, twice-weekly e-newsletters, alerts and 
Webinars, WaterlSAC delivers a rich and thorough physical and cyber threat information; guidance 
on risk management, mitigation, and resilience; and contaminant databases. Members include 
hundreds of utilities serving more than 200 million people in the United States, as well as Federal, 
State, and local agencies and consulting firms. 174 

The Water Environmental Research Foundation (WERF), an independent scientific research 
organization dedicated to wastewater and stormwater issues, provides tools and knowledge to 
water managers and urban planners. 175 One example is the Integrated Urban Water Model 
(IUWM), a mass balance model that provides a tool for water managers to forecast water demand, 
waste, and associated costs for various water management scenarios. In addition, WERF developed 
an information brief, Tools for Evaluating the Benefits of Green Infrastructure for Urban Water 
Management, which provides overviews for two analysis methods gaining popularity in the urban 
planning field—life-cycle cost analysis and triple bottom line—as they apply to stormwater and 
urban water management. 176 

New York City's Green Infrastructure Program is a multiagency effort led by the Department of 
Environmental Protection (DEP) to design, construct and maintain a variety of sustainable green 
infrastructure practices for city-owned property (e.g., streets, sidewalks, schools, and public 
housing). The program promotes practices that mimic the natural flow of water to manage 
stormwater runoff from streets, sidewalks, parking lots and rooftops to engineered systems that 
typically feature soils, stones, and vegetation. This process prevents stormwater runoff from 
entering the city's sewer systems. DEP is also building green infrastructure in compliance with the 
New York Department of Environmental Conservation requirements to reduce combined sewer 
overflow discharges into the city's water bodies through the use of a separate storm sewer system. 

The Green Infrastructure Toolkit, designed by the New York City DEP, educates homeowners, 
community gardeners, and others interested in stormwater management techniques to minimize 
the effects of rainfall on water bodies in cities with combined sewers and other places that 


172 Uni-Group USA, "Green and Stormwater Calculators." 

173 National Council of ISACs, "About ISACs." 

174 WaterlSAC, "About Water ISAC." 

175 Sharvelle, Development of the Integrated Urban Water Management Too I, 2012; and Weinstein, Tools for 
Evaluating the Benefits of Green Infrastructure for Urban Water Management, 2012. 

176 Weinstein, Tools for Evaluating the Benefits of Green Infrastructure for Urban Water Management, 2012. 
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experience flooding and storm water problems. The photographs, detail drawings, material lists, and 
text provide a starting point for those interested in utilizing these practices in their homes, gardens 
and communities. The toolkit also includes a printable version of green infrastructure techniques. 177 

Developed by the CIPAC Water Sector Strategic Priorities Working Group, the 2013 Roadmap to a 
Secure & Resilient Water Sector establishes a strategic framework that articulates the priorities of 
industry and government in the Water Sector to manage and reduce risk, and also produces an 
actionable path forward for the Water Sector Government Coordinating Council, Water Sector 
Coordinating Council, and government and private sector security partners in the sector to improve 
the sector's security and resilience within the next five years. The roadmap establishes three top 
priority activities for the Water Sector: 1) Advance the development of sector-specific cybersecurity 
resources; 2) Raise awareness of the Water Sector as a lifeline sector and recognize the priority 
status of its needs and capabilities; and 3) Support the development and employment of tools, 
training, and other assistance to enhance preparedness and resilience. 178 

M19 Emergency Planning for Water Utilities, Fourth Edition, developed by AWWA, provides 
guidelines and procedures that can be used by utilities of any size to develop an emergency 
preparedness plan, identify vulnerabilities in the water system, and determine how a disruption 
would likely impact service. Originally issued in 1973 and updated most recently in 2001, revisions of 
the manual are in progress to reflect current the state of knowledge regarding emergency 
preparedness and the AWWA G440 guides. 179 

The Water and Wastewater Treatment Technologies Appropriate for Reuse (WAWTTAR), a 

predictive program developed by Humboldt University, enables planners to select suitable water 
and wastewater treatment options appropriate to the material and manpower resources available 
to particular communities throughout the world. The localized performance and cost of a large 
number of possible systems can be estimated with WAWTTAR for any location and condition for 
which basic information on the problem to be solved is available. While the initial target audience 
was outside the United States, WAWTTAR has found considerable utility by engineers involved in 
small community project planning in the United States. 180 

The National Association of Clean Water Agencies (NACWA), the WERF, and the Water Environment 
Federation (WEF) collaborated on The Water Resources Utility of the Future: A Blueprint for Action. 
This report captures a fundamental shift in the way clean water utilities in the United States define 
their role in society (i.e., from managers of waste to managers of valuable resources). The blueprint 
provides examples of initiatives in energy and materials recovery and reuse, water reuse, and green 
infrastructure, and a new openness on the part of clean water utilities to partner with developers of 
technology, design engineers, and the public and private finance community. 181 


177 NYC DEP, "NYC Green Infrastructure Program;" and Grow NYC, "Green Infrastructure Toolkit." 

178 CIPAC Water Sector Strategic Priorities Working Group, Roadmap to a Secure and Resilient Water Sector, 
2013. 

179 AWWA, M19 Emergency Planning for Water Utilities, Fourth Edition, 2001. 

180 WAWTTAR, "Homepage." 
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NIAC Water Sector Resilience Final Report and Recommendations 


169 



The WaterLex Toolkit's budgeting tool assists development partners to develop a budget for their 
program to ensure that water and sanitation services are supplied in a financially sustainable 
manner. The tool focuses on assessing financial capabilities, developing a financing plan, and making 
decisions about capital and recurring expenditures. 182 

III. CHARACTERIZING EMERGING THREATS 


The AWWA J100-10 (R13) Risk and Resilience Management of Water and Wastewater Systems 
(RAMCAP) guide documents a process for identifying and communicating security vulnerabilities 
and provides methods to evaluate the options for improving these weaknesses. It includes 
methodology to identify, analyze, quantify, and communicate the risks of specific terrorist attacks 
and natural hazards against critical water and wastewater systems. In addition, it establishes 
requirements for the risk and resilience assessment and management process that inform decisions 
on where to allocate resources to reduce risk and enhance resilience through countermeasures and 
mitigation strategies. This standard received SAFETY Act designation from DHS. 183 

The U.S. Water Alliance's One Water Management program supports and enhances a more holistic 
approach to water management. The approach—in both policy and practice—is expanding across 
the sector because it is recognized as necessary to support sustained sector-wide resilience. 
Examining water management in an integrated way across water sources and water uses is key to a 
sustainable and resilient water future. As such, the Alliance is building a network of leaders 
representing research foundations, national trade associations, Federal agencies, companies, and 
nongovernmental organizations to unite for integrated water management. The Alliance's One 
Water Management vision is closely aligned with and builds upon the extensive national and global 
work on Integrated Water Resources Management (IWRM). 184 

EPA National Homeland Security Research Center and AWWA prepared the Planning for an 
Emergency Drinking Water Supply report to respond to the 2002 Bioterrorism Act that directed EPA 
to conduct "a review of the methods and means by which alternative supplies of drinking water 
could be provided in the event of destruction, impairment or contamination of public water 
systems" (42 U.S.C. 300i-4 (b)." This report details options and plans to provide drinking water in 
situations where public water systems are compromised. 185 

Produced by AWWA, Process Control System Security Guidance for the Water Sector provides a 
consistent and repeatable course of action to reduce vulnerabilities in process control systems and 
identifies specific recommended cybersecurity practices for the sector. 186 It builds and expands 
upon the 2008 Roadmap to Secure Control Systems in the Water Sector, developed by the Water 
Sector Coordinating Council Cyber Security Working Group with AWWA sponsorship. 187 


182 WaterLex, "Budgeting Tool: Budgeting sustainable water and sanitation services." 

183 AWWA, A l/l/l/l/A J100-10 (R13) Risk and Resilience Management of Water and Wastewater Systems, 2010. 

184 U.S. Water Alliance, "One Water Hub." 

185 EPA, Planning for an Emergency Drinking Water Supply, 2011. 

186 AWWA, Process Control System Security Guidance for the Water Sector, 2014. 
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After-Action Reports (AARs) issued following a variety of disasters and emergencies share successes 
and areas for improvement. The WARN Superstorm Sandy After-Action Report is based on 
information shared by impacted utilities, State and Federal partners, and WARNs in the impacted 
States. High priorities for improvement in the sector, identified by this AAR, include intrastate 
mutual aid and assistance, interstate mutual aid and assistance, the need to elevate the priority 
status of water infrastructure, the energy and water nexus in disasters, site access, coordination, 
situational awareness, and communications. 188 

EPA has drawn upon the WARN AAR as well as other post-Sandy studies to improve its response to 
major events impacting the Water Sector. Other important AARs include: 

• New York City, Hurricane Sandy After Action (May 2013) 189 

DHS, Lessons Learned: Social Media and Hurricane Sandy (June 2013) 190 

• FEMA, Hurricane Sandy FEMA After-Action Report (July 1, 2013) 191 

• NERC, Hurricane Sandy Event Analysis Report (January 2014) 192 

AMWA and NACWA hosted a Water Resilience Summit in April 2014, convening key Federal and 
municipal agency leaders to outline the collaborative actions to address climate change and 
enhance resilience. The summit focused on how to ensure the Water Sector becomes more resilient, 
while allocating resources and mitigating some of the enormous costs more effectively than in 
previous post-disaster recovery and relief efforts. Participants of the summit identified 
opportunities for Federal agencies, States and utilities to influence progress on resilience through 
planning, funding, and financing; permitting and regulatory flexibility; public education and 
community outreach; and partnerships and coordination at all levels of government. 193 


188 AWWA, WARN Superstorm Sandy After-Action Report, 2013. 

189 NYC. Hurricane Sandy After Action, 2013. 

190 DFIS S&T, Lessons Learned: Social Media and Hurricane Sandy, 2013. 

191 FEMA, Hurricane Sandy FEMA After-Action Report, 2013. 
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APPENDIX K. 

ACRONYMS 


Acronym 

Definition 

AAR 

After Action Report 

ASDWA 

Association of State Drinking Water Administrators 

AER 

Atmospheric and Environmental Research 

AMWA 

Association of Metropolitan Water Agencies 

ANSI 

American National Standards Institute 

ARPA 

Advanced Research Projects Agency 

ASCE 

American Society of Civil Engineers 

ASDWA 

Association of State Drinking Water Administrators 

ASIWPCA 

Association of State and Interstate Water Pollution Control Administrators 

ASWM 

Association of State Wetland Managers 

AWWA 

American Water Works Association 

BLM 

Bureau of Land Management 

BNR 

Biological Nutrient Reduction 

CBR 

Chemical, Biological, or Radiological 

CBWR 

Community-Based Water Resiliency 

CEO 

Chief Executive Officer 

CDC 

Centers for Disease Control and Prevention 

Cl 

Critical Infrastructure 

CIFA 

Council of Infrastructure Financing Authorities 

CIKR 

Critical Infrastructure and Key Resources 

CIPAC 

Critical Infrastructure Partnership Advisory Council 

CISR 

Critical Infrastructure Security and Resilience 

COBIT 

Control Objectives for Information and Related Technology 

CRS 

Congressional Research Service 

CSO 

Combined Sewer Overflows 

CWA 

Clean Water Act 

CWS 

Commercial Water System 

CWSRF 

Clean Water State Revolving Fund 

DEED 

Minnesota Department of Employment and Economic Development 

DEP 

Department of Environmental Protection 

DHS 

U.S. Department of Homeland Security 

DOD 

U.S. Department of Defense 

DOE 

U.S. Department of Energy 

DOI 

U.S. Department of Interior 

DOT 

U.S. Department of Transportation 
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Acronym 

Definition 

EIS 

Environmental Impact Statements 

EMAC 

Emergency Management Assistance Compact 

EO 

Executive Order 

EOC 

Emergency Operations Center 

EPA 

U.S. Environmental Protection Agency 

ERP 

Emergency Response Plan 

ESF 

Emergency Support Function 

EWSP 

Emergency Water Supply Plan 

FAST 

Fixing America's Surface Transportation 

FBI 

Federal Bureau of Investigation 

FCC 

Federal Communications Commission 

Fed FUNDS 

Federal Funding for Utilities for Water/Wastewater in National Disasters 

FEMA 

Federal Emergency Management Agency 

FFRMS 

Federal Flood Risk Management Standard 

FY 

Fiscal Year 

GCC 

Government Coordinating Council 

GDP 

Gross Domestic Product 

HEC 

Hydrologic Engineering Center 

HHS 

U.S. Department of Health and Human Services 

HMGP 

Hazard Mitigation Grant Program 

HSPD 

Homeland Security Presidential Directive 

HUD 

U.S. Department of Housing and Urban Development 

IDT 

Infrastructure Data Taxonomy 

IP 

Office of Infrastructure Protection 

ISAC 

Information Sharing and Analysis Center 

IT 

Information Technology 

ITIL 

IT Infrastructure Library 

IUWM 

Integrated Urban Water Model 

IWRM 

Integrated Water Resources Management 

LADWP 

Los Angeles Department of Water and Power 

LIHEAP 

Lower Income Home Energy Assistance Program 

MCHM 

Methylcyclohexane methanol 

MDEQ 

Michigan Department of Environmental Quality 

MDHHS 

Michigan Department of Health and Human Services 

Mn/DOT 

Minnesota Department of Transportation 

MWD 

Metropolitan Water District of Southern California 

NACWA 

National Association of Clean Water Agencies 

NAWC 

National Association of Water Companies 

NDRF 

National Disaster Recovery Framework 
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Acronym 

Definition 

NEHRP 

National Earthquake Hazards Reduction Program 

NERC 

North American Electric Reliability Corporation 

NIAC 

National Infrastructure Advisory Council 

NIMS 

National Incident Management System 

NIPP 

National Infrastructure Protection Plan 

NIST 

National Institute of Standards and Technology 

NOAA 

National Oceanic and Atmospheric Association 

NPDES 

National Pollutant Discharge Elimination System 

NPS 

National Park Service 

NRF 

National Response Framework 

NRWA 

National Rural Water Association 

NSC 

National Security Council 

NTSB 

National Transportation Safety Board 

NWP 

National Water Program 

OCIA 

Office of Cyber and Infrastructure Analysis 

OCS 

Office of Community Services 

ODNI 

Office of the Director of National Intelligence 

OGWDW 

Office of Ground Water and Drinking Water 

OHS 

Office of Homeland Security 

OLEM 

Office of Land and Emergency Management 

OMB 

Office of Management and Budget 

OP 

Office of Policy 

OST 

Office of Science and Technology 

OSWER 

Office of Solid Waste and Emergency Response 

OW 

Office of Water 

OWM 

Office of Wastewater Management 

PDM 

Pre-Disaster Mitigation 

POTW 

Publicly Owned Treatment Work 

PPD 

Presidential Policy Directive 

PPH 

Propylene glycol phenyl ether 

PWS 

Public Water System 

R&D 

Research and Development 

RAMCAP 

Risk and Resilience Management of Water and Wastewater Systems 

RIPP 

Regional Infrastructure Protection Plans 

RPS 

Renewable Portfolio Standard 

RRAP 

Regional Resiliency Assessment Program 

SCADA 

Supervisory Control and Data Acquisition 

see 

Sector Coordinating Council 

SDWA 

Safe Drinking Water Act 
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Acronym 

Definition 

SEP 

State Energy Program 

SFPUC 

San Francisco Public Utilities Commission 

SLTT 

State, Local, Tribal, and Territorial 

SMART 

Sustain and Manage American Resources for Tomorrow 

SRF 

State Revolving Fund 

SSA 

Sector-Specific Agency 

SSP 

Sector-Specific Plan 

TMDL 

Total Maximum Daily Load 

UOTF 

Utility of the Future 

USACE 

U.S. Army Corps of Engineers 

USDA 

U.S. Department of Agriculture 

USGS 

U.S. Geological Survey 

VRA 

Virginia Pooled Finance 

VSAT 

Vulnerability Self-Assessment Tool 

WARN 

Water/Wastewater Agency Response Network 

WAWTTAR 

Water and Wastewater Treatment Technologies Appropriate for Reuse 

WEF 

Water Environment Federation 

WERF 

Water Environment Research Foundation 

WHEAT 

Water Health and Economic Analysis Tool 

WIFIA 

Water Infrastructure Finance and Innovation Act 

WIN 

Water Infrastructure Network 

WRF 

Water Research Foundation 

WRRDA 

Water Resources Reform and Development Act 

Water SCC 

Water Sector Coordinating Council 

WSD 

Water Security Division 
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